Service manual

Chapter 5: Administration 75
Table 5.5: Destination Drivers Parameters (Syslog-ng Configuration)
Option Description
file
(filename[options])
This is one of the most important destination drivers in syslog-ng. It allows
you to output log messages to the named file. The destination filename may
include macros (by prefixing the macro name with a '$' sign) which gets
expanded when the message is written. Since the state of each created file
must be tracked by syslog-ng, it consumes some memory for each file. If no
new messages are written to a file within 60 seconds (controlled by the
time_reap global option), it's closed, and its state is freed.
Available macros in filename expansion:
HOST - The name of the source host from where the message originated.
FACILITY - The name of the facility from which the message is tagged.
PRIORITY or LEVEL - The priority of the message.
PROGRAM - The name of the program the message was sent by.
YEAR, MONTH, DAY, HOUR, MIN, SEC - The year, month, day, hour, min,
sec of the message was sent.
TAG - Equals FACILITY/LEVEL.
FULLHOST - The name of the source host and the source-driver:
<source-driver>@<hostname>
MSG or MESSAGE - The message received.
FULLDATE - The date of the message was sent.
Available options:
log_fifo_size(number) - The number of entries in the output file.
sync_freq(number) - The file is synced when this number of messages has
been written to it.
owner(name), group(name), perm(mask) - Equals global options.
template(“string”) - Syslog-ng writes the “string” in the file. You may use the
MACROS in the string.
encrypt(yes/no) - Encrypts the resulting file.
compress(yes/no) - Compresses the resulting file using zlib.
pipe
(filename[options])
This driver sends messages to a named pipe. Available options:
owner(name), group(name), perm(mask) - Equals global options.
template(“string”) - Syslog-ng writes the “string” in the file. You may use the
MACROS in the string.
unix-stream(filename) and
unix-dgram(filename)
This driver sends messages to a UNIX socket in either SOCKET_STREAM
or SOCK_DGRAM mode.
udp(“<ip address>”
port(number);) and
tcp("<ip address>"
port(number);)
This driver sends messages to another host (ip address/port) using either
UDP or TCP protocol.
program(<program name
and arguments>)
This driver fork executes the given program with arguments and sends
messages down to the stdin of the child.
usertty(<username>) This driver writes messages to the terminal of a logged-in username.