Skip to main content

​
Overview

Syslog is a protocol used for sending and storing log messages across networked devices and systems. With Syslog, you can collect and analyze log messages, monitor system and network activity, set up centralized log management, and automate responses to critical events. This enhances operational visibility and ensures the reliability and stability of your applications and infrastructure. Follow the steps below to configure log shipping to Syslog.

​
Step 1 - Prerequisites

  • Syslog Endpoint: A reachable hostname for your Syslog server.
  • Port: Standard Syslog uses port 514. Use the port your server listens on for the selected mode.

​
Step 2 - Configure External Logging

External logging can be configured by using either the UI Console or CLI.

​
Enable Logging using the UI Console

  1. From the Control Plane Console UI, click on Org in the left menu.
  2. Click External Logs in the middle context menu.
  3. Select Syslog and fill out the required fields.
  4. Click Save.
  5. After the configuration is complete, log entries will begin forwarding to your Syslog Server within a few minutes.

​
Enable Logging using the CLI

The external logging configuration can be created / updated using the CLI’s cpln org patch ORG_NAME -f FILE.yaml command. Below is an example of an Org manifest (in YAML). Edit and save the YAML as a file and use it as an input to the CLI’s cpln org patch ORG_NAME -f FILE.yaml command.
  • Substitute: ORG_NAME, HOST_NAME, PORT, and possibly the mode, format, and severity.
YAML

​
Configuration Fields

In the Console, mode, format, and severity are pre-filled with tcp, rfc3164, and 6. A manifest must set all of them. The gvc is sent as the hostname, the workload as the application name, the replica as the process ID, and the log line as the message.

​
Message Size Limits

Messages larger than the limit are truncated. The limit applies to the whole syslog message, including the header, and depends on the format. It is the same for tcp, udp, and tls.
Very long container log lines may already be split into several log entries by the container runtime before they are forwarded. Each entry is sent as a separate syslog message.
With udp, each message is sent as a single datagram. Large datagrams may be fragmented on the network, and a lost fragment drops the whole message. Use tcp or tls if you need large messages delivered reliably.