Chapter 3. Reference

Table of Contents
Source drivers
Destination drivers
Filter functions
Options

This chapter documents the drivers and options you may specify in the configuration file.

Source drivers

The following drivers may be used in the source statement, as described in the previous chapter.

internal()

All internally generated messages "come" from this special source. If you want warnings, errors and notices from syslog-ng itself, you have to include this source in one of your source statement.

This driver has no positional nor optional parameters.

Syslog-ng will print you a warning, if this driver is not referenced.

unix-stream() and unix-dgram()

This two drivers behave similarly: they open the given AF_UNIX socket, and start listening on them for messages. unix-stream() is primarily used on Linux, and uses SOCK_STREAM semantics (connection oriented, no messages are lost), unix-dgram() is used on BSDs, and uses SOCK_DGRAM semantics, this may result in lost local messages, if the system is overloaded.

To avoid denial of service attacks when using connection-oriented protocols, the number of simoultaneously accepted connections should be limited. This can be achieved using the max-connections() parameter.

There's a required positional argument, which specifies the name of the socket to open, and other optional parameters may be specified as follows:

Table 3-1. Available options for unix-stream

NameTypeDescriptionDefault
owner()stringSet the uid of the socket.root
group()stringSet the gid of the socket. Default: root.root
perm()numberSet the permission mask. For octal numbers prefix the number with '0', e.g. use 0755 for rwxr-xr-x.0666
keep-alive()yes or noSelects whether to keep connections opened when syslog-ng is restarted, can be used only with unix-stream(). Default: yes.yes
max-connections()numberLimits the number of simoultaneously opened connections. Can be used only with unix-stream().10

Example 3-1.

	    unix-stream("/dev/log" max-connections(10)); };
	  

tcp() and udp()

These drivers let you accept messages from the network.