syslog

This optional clause creates a syslog logger, which logs all messages with a specified priority level or higher to the syslog system.

Messages are logged to syslog with severity levels that depend on the severity of the message. There are 8 defined priority levels in syslog, and they are logged to the equivalent syslog priority. The priority levels with their corresponding values and descriptions are:

• Emergency (0): System is unusable
• Alert (1): Immediate action needed
• Critical (2): Critical conditions
• Error (3): Error conditions
• Warning (4): Warning conditions
• Notice (5): Normal but significant conditions
• Informational (6): Informational messages
• Debug (7): Debug-level messages

Example configuration of a syslog logger:

syslog {
    loglevel info;
    facility "daemon";
    # optional syslog format override: rfc3164, rfc5424, or json
    #format rfc5424;

    # optional syslog unix domain socket path
    #filename /var/run/syslog;

    # optional in-memory queue size, defaults to 8192
    queue-size 8192;

    # optional overflow file for rows that cannot enter the syslog queue
    overflow-file {
        filename "radiator-syslog-overflow.log";
        rotate {
            size 100MiB;
            keep 5;
        }
    }
}

The overflow-file clause is optional. When configured, Radiator writes syslog rows to this file if syslog delivery is slow or failed. This keeps syslog delivery from blocking the normal file, memory, and console logging path while still preserving overflowed syslog rows for later inspection.

The optional format parameter overrides the syslog message format. If you omit it, Radiator uses RFC 3164 for the local Unix socket and RFC 5424 for TCP and TLS.

• rfc3164: Use RFC 3164.
• rfc5424: Use RFC 5424.
• json: Use a JSON Radiator log payload inside the transport-selected syslog envelope.

The legacy json_log; keyword is still supported in syslog logger blocks. It is equivalent to format json;.

For RFC-compliant remote syslog, omit format or use format rfc5424 with protocol tcp or protocol tls. Radiator then sends RFC 5424 syslog messages over octet-counted stream framing. Use format rfc3164 with TCP or TLS only for legacy receivers that require RFC 3164 messages over a stream transport.

RFC 3164 timestamps are generated in UTC on Unix systems. RFC 5424 timestamps are generated in UTC.

Application syslog payloads omit the separate Radiator structured log timestamp because the syslog header already carries the event time.

The default transport is the local Unix syslog socket. Use filename only with the default transport.

For remote syslog over TCP, configure protocol tcp with a host and port:

syslog {
    loglevel info;
    facility "daemon";
    protocol tcp;
    host "syslog.example.com";
    port 514;
}

For TCP and TLS, host and port are required. Do not configure filename with TCP or TLS.

When host resolves to multiple IP addresses, Radiator connects to the first address that accepts the connection, trying them in resolver order (it does not connect to several at once or load-balance). The remaining addresses are only tried if earlier ones fail. Once connected, all logs go to that address until the connection breaks; failover to another address happens on the next reconnect. The host name is re-resolved on every reconnect, so DNS changes are picked up automatically. For TLS, the server certificate is verified against the configured host name regardless of which resolved IP address is used. For active load balancing across several receivers, use a syslog relay such as syslog-ng or rsyslog.

TCP uses RFC 6587 octet-counting framing. TLS uses the same octet-counted message framing required by RFC 5425. Configure the remote syslog receiver to accept octet-counted stream framing.

For syslog over TLS, use protocol tls. TLS verifies the syslog server certificate against the configured server_ca_certificate values. If no tls { ... } block is configured, Radiator uses the operating system native trust roots.

Add a tls { ... } block to configure CA certificates, client certificates, protocol versions, CRLs, or an @verification policy.

If no client certificate is configured, Radiator does not send one. If you configure certificate_key or client_ca_certificate, you must also configure certificate.

syslog {
    loglevel info;
    facility "daemon";
    protocol tls;
    host "syslog.example.com";
    port 6514;
    tls {
        min_protocol_version tlsv12;
    }
}