Download logFaces User Manual

Copyright ©2009-2015 Moonlit Software Ltd, All rights reserved
2.9.2.2
Syslog receivers
logFaces server has its own embedded syslog server which can be used to consume syslog
messages from any source using TCP or UDP connections compliant with RFC5424 or RFC3164.
Current implementation of syslog server is designed to works as a collector, or final destination of
syslog events, meaning that it's not designed to relay (or forward) received events to other syslog
servers.
Consuming syslog data is no different from consuming log data from other socket appenders. All you
need to do is to define syslog receivers and setup their parameters properly. Because syslog is a
very loose specification and incredibly fragmented amongst magnitude of devices using it, there are
many ways of how to extract the important information and map it to real data which is later used by
logFaces.
Using regular expressions you will be able to do most of the mappings. Everything about working
with syslog revolves around settings up and testing syslog receivers:
Figure 2.9.4: Adding syslog receivers
24