Hello, I'm looking for an advice. I'm sending the logs from my machine to a third-party server. The protocol between the client (syslog-ng service) and the third-party server is quite simple: for each received log entry the server replies with a confirmation message on the same tcp socket. Currently I'm using a simple syslog-ng config to send logs via network driver to a specified ip/port. However, since syslog-ng service doesn't receive/read the messages from the server, the connection eventually dies. Is there any way to modify syslog-ng config to allow reads after writes? I didn't find anything similar in the documentation. An alternative way seems to be implementing a syslog-ng module or a plugin. Would that be the right approach? It seems that I can customize _LogProtoClient structure, and create a plugin. But I have no clue on how the overall API looks like, and what are the steps to build the module. Could you guys point me to the right resources? Is there any sample plugin, or a guidance for developing custom plugins? Thank you in advance, Dmitry
Hi Dmitry, The simplest way would be to use a Python destination. You can write your own one based on the documentation: https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/sec... I don't know the performance limits of it, I hope it's enough for you. Best, Tibor 2016-06-15 8:47 GMT+02:00 Dmitry Shmulevich <dima8080@gmail.com>:
Hello,
I'm looking for an advice.
I'm sending the logs from my machine to a third-party server. The protocol between the client (syslog-ng service) and the third-party server is quite simple: for each received log entry the server replies with a confirmation message on the same tcp socket. Currently I'm using a simple syslog-ng config to send logs via network driver to a specified ip/port. However, since syslog-ng service doesn't receive/read the messages from the server, the connection eventually dies.
Is there any way to modify syslog-ng config to allow reads after writes? I didn't find anything similar in the documentation.
An alternative way seems to be implementing a syslog-ng module or a plugin. Would that be the right approach? It seems that I can customize _LogProtoClient structure, and create a plugin. But I have no clue on how the overall API looks like, and what are the steps to build the module.
Could you guys point me to the right resources? Is there any sample plugin, or a guidance for developing custom plugins?
Thank you in advance, Dmitry
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Thank you Tibor, Right, I'm expecting a high volume of logs. Is there any example of syslog-ng module in C/C++/Go? Thanks Dmitry On Wed, Jun 15, 2016 at 12:11 AM, Tibor Benke <ihrwein@gmail.com> wrote:
Hi Dmitry,
The simplest way would be to use a Python destination. You can write your own one based on the documentation: https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/sec...
I don't know the performance limits of it, I hope it's enough for you.
Best, Tibor
2016-06-15 8:47 GMT+02:00 Dmitry Shmulevich <dima8080@gmail.com>:
Hello,
I'm looking for an advice.
I'm sending the logs from my machine to a third-party server. The protocol between the client (syslog-ng service) and the third-party server is quite simple: for each received log entry the server replies with a confirmation message on the same tcp socket. Currently I'm using a simple syslog-ng config to send logs via network driver to a specified ip/port. However, since syslog-ng service doesn't receive/read the messages from the server, the connection eventually dies.
Is there any way to modify syslog-ng config to allow reads after writes? I didn't find anything similar in the documentation.
An alternative way seems to be implementing a syslog-ng module or a plugin. Would that be the right approach? It seems that I can customize _LogProtoClient structure, and create a plugin. But I have no clue on how the overall API looks like, and what are the steps to build the module.
Could you guys point me to the right resources? Is there any sample plugin, or a guidance for developing custom plugins?
Thank you in advance, Dmitry
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
The simplest way to create a plugin is to use the logthrdestination interface. There are examples of that in the existing modules. The log proto interface plugs into the existing tcp/udp/network/syslog drivers, they are used when transport() option is specified. Thank you Tibor, Right, I'm expecting a high volume of logs. Is there any example of syslog-ng module in C/C++/Go? Thanks Dmitry On Wed, Jun 15, 2016 at 12:11 AM, Tibor Benke <ihrwein@gmail.com> wrote:
Hi Dmitry,
The simplest way would be to use a Python destination. You can write your own one based on the documentation: https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/sec...
I don't know the performance limits of it, I hope it's enough for you.
Best, Tibor
2016-06-15 8:47 GMT+02:00 Dmitry Shmulevich <dima8080@gmail.com>:
Hello,
I'm looking for an advice.
I'm sending the logs from my machine to a third-party server. The protocol between the client (syslog-ng service) and the third-party server is quite simple: for each received log entry the server replies with a confirmation message on the same tcp socket. Currently I'm using a simple syslog-ng config to send logs via network driver to a specified ip/port. However, since syslog-ng service doesn't receive/read the messages from the server, the connection eventually dies.
Is there any way to modify syslog-ng config to allow reads after writes? I didn't find anything similar in the documentation.
An alternative way seems to be implementing a syslog-ng module or a plugin. Would that be the right approach? It seems that I can customize _LogProtoClient structure, and create a plugin. But I have no clue on how the overall API looks like, and what are the steps to build the module.
Could you guys point me to the right resources? Is there any sample plugin, or a guidance for developing custom plugins?
Thank you in advance, Dmitry
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (3)
-
Dmitry Shmulevich
-
Scheidler, Balázs
-
Tibor Benke