Syslog

You can send your system logs directly to our servers over an encrypted TCP connection. Our Syslog server is listening for TCP connections on in.logtail.com:6514 and it allows only encrypted traffic.
To authenticate the incoming logs, we utilize Syslog's structured data mechanism. Every Syslog message you send to our server must include [[email protected] source_token="YOUR_LOGTAIL_SOURCE_TOKEN"].
Setup guide
rsyslog setup
syslog-ng setup
rsyslog - manual setup
syslog-ng - manual setup
First, make sure rsyslog-gnutls is installed on your system:
1
apt install rsyslog-gnutls
Copied!
We created a simple script that will configure rsyslog for you:
1
wget -qO- https://logtail.com/rsyslog/YOUR_SOURCE_TOKEN | sh
Copied!
We suggest you go through the setup script before you run it and make sure it doesn't do anything malicious. You should never run scripts copied from the internet in your terminal.
The script will detect whether rsyslog is installed on your system and if it is is in place, it will create the correct configuration for your Logtail source.
After the script finishes successfully, you might need to restart the rsyslog service so that the new configuration is loaded:
1
systemctl restart rsyslog
Copied!
We created a simple script that will configure syslog-ng for you:
1
wget -qO- https://logtail.com/syslog-ng/YOUR_SOURCE_TOKEN | sh
Copied!
We suggest you go through the setup script before you run it and make sure it doesn't do anything malicious. You should never run scripts copied from the internet in your terminal.
The script will detect whether syslog-ng is installed on your system and if it is is in place, it will create the correct configuration for your Logtail source. The script will download Let's Encrypt root certificates, but it won't install them globally.
After the script finishes successfully, you might need to restart the syslog-ng service so that the new configuration is loaded:
1
systemctl restart syslog-ng
Copied!
1. Install rsyslog-gnutls to enable TLS encryption:
1
apt install rsyslog-gnutls
Copied!
2. Create a configuration file with the following content:
/etc/rsyslog.d/70-logtail.conf
1
global(DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")
2
​
3
template(name="LogtailFormat" type="list") {
4
 constant(value="<")
5
 property(name="pri")
6
 constant(value=">")
7
 constant(value="1")
8
 constant(value=" ")
9
 property(name="timestamp" dateFormat="rfc3339")
10
 constant(value=" ")
11
 property(name="hostname")
12
 constant(value=" ")
13
 property(name="app-name")
14
 constant(value=" ")
15
 property(name="procid")
16
 constant(value=" ")
17
 property(name="msgid")
18
 constant(value=" ")
19
 property(name="structured-data" regex.expression="[^-]" regex.nomatchmode="BLANK" regex.submatch="0")
20
 constant(value="[[email protected] source_token=\"YOUR_LOGTAIL_SOURCE_TOKEN\"]")
21
 constant(value=" ")
22
 property(name="msg" droplastlf="on")
23
}
24
​
25
action(
26
 type="omfwd"
27
 protocol="tcp"
28
 target="in.logtail.com"
29
 port="6514"
30
 template="LogtailFormat"
31
 TCP_Framing="octet-counted"
32
 StreamDriver="gtls"
33
 StreamDriverMode="1"
34
 StreamDriverAuthMode="x509/name"
35
 StreamDriverPermittedPeers="*.logtail.com"
36
 queue.spoolDirectory="/var/spool/rsyslog"
37
 queue.filename="logtail"
38
 queue.maxdiskspace="75m"
39
 queue.type="LinkedList"
40
 queue.saveonshutdown="on"
41
)
Copied!
Make sure to replace YOUR_LOGTAIL_SOURCE_TOKEN with your own source token from Logtail.com.
This configuration works on Ubuntu or other Debian-based Linux distributions. Other Linux distributions might have the file with the trusted root CA can be in a different location and the file have a different name. If this is the case, please change the file path on the first line to the correct value (e.g., /etc/ssl/certs/ca-bundle.crt).
3. Restart the rsyslog service and you're done:
1
systemctl restart rsyslog
Copied!
1. Download CA certificates (Let's Encrypt) to enable TLS:
1
mkdir -p /etc/syslog-ng/ca.d
2
cd /etc/syslog-ng/ca.d
3
​
4
# Let's Encrypt R3 intermediate certificate (cross signed by TrustID X3 Root)
5
wget https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem
6
ln -s lets-encrypt-r3-cross-signed.pem $(openssl x509 -in lets-encrypt-r3-cross-signed.pem -hash -noout).0
7
​
8
# TrustID X3 Root from IdenTrust
9
wget https://letsencrypt.org/certs/trustid-x3-root.pem
10
ln -s trustid-x3-root.pem $(openssl x509 -in trustid-x3-root.pem -hash -noout).0
11
​
12
# ISRG Root X1
13
wget https://letsencrypt.org/certs/isrgrootx1.pem
14
ln -s isrgrootx1.pem $(openssl x509 -in isrgrootx1.pem -hash -noout).0
Copied!
The links to the certificates are taken from the Let's Encrypt website. You can read more about the setup in the syslog-ng documentation.
2. Create a config file with the following content:
/etc/syslog-ng/conf.d/70-logtail.conf
1
destination d_logtail {
2
 syslog(
3
   "in.logtail.com"
4
   transport("tls")
5
   port(6514)
6
   tls(
7
     peer-verify(required-trusted)
8
     ca-dir("/etc/syslog-ng/ca.d")
9
     trusted-dn("CN=*.logtail.com")
10
   )
11
 );
12
};
13
​
14
rewrite add_logtail_credentials {
15
 set("YOUR_LOGTAIL_SOURCE_TOKEN" value("[email protected]_token"));
16
};
17
​
18
log {
19
 source(s_src);
20
 rewrite(add_logtail_credentials);
21
 destination(d_logtail);
22
};
Copied!
Make sure you replace YOUR_LOGTAIL_SOURCE_TOKEN with your own source token from Logtail.com. 
3. Restart the syslog-ng service:
1
systemctl restart syslog-ng
Copied!
​
​

🔀️ Log forwarding - Previous

Fluentd

Next - API

Getting Started

Last modified 7mo ago

Copy link

Contents

Setup guide