Destination drivers

Destination drivers output log messages to somewhere outside syslog-ng: a file or a network socket.

file()

The file driver is one of the most important destination drivers in syslog-ng. It allows you to output logmessages to the named file, or as you'll see to a set of files.

The destination filename may include macros which gets expanded when the message is written, thus a simple file() driver may result in several files to be created. Macros can be included by prefixing the macro name with a '$' sign (without the quotes), just like in Perl/PHP.

If the expanded filename refers to a directory which doesn't exist, it'll be created depending on the create_dirs() setting (both global and a per destination option)

Warning: since the state of each created file must be tracked by syslog-ng, it consumes some memory for each file. If no new messages are written to a file within 60 seconds (controlled by the time_reap global option), it's closed, and its state is freed.

Exploiting this a DoS attack can be mounted against your system. If the number of possible destination files and its needed memory is more than the amount your logserver has.

The most suspicious macro is $PROGRAM, where the possible variations is quite high, so in untrusted environments $PROGRAM usage should be avoided.

pipe()

This driver sends messages to a named pipe like /dev/xconsole

unix-stream() & unix-dgram()

This driver sends messages to a unix socket in either SOCK_STREAM or SOCK_DGRAM mode.

udp() & tcp()

This driver sends messages to another host on the local intranet or internet using either UDP or TCP protocol.

usertty()

This driver writes messages to the terminal of a logged-in user.

program()

This driver fork()'s executes the given program with the given arguments and sends messages down to the stdin of the child.