TCP Syslog Output

This is a Graylog Enterprise feature. A valid Graylog Enterprise license is required.

TCP Syslog Output allows you to send data as UTF-8 encoded text to an arbitrary TCP Syslog receiver. The formatted payload is sent as the MSG portion of a standard Syslog message per section 6.4 of the Syslog specification.

Output Configuration

The TCP Syslog Output supports all of the standard Enterprise Output Framework configuration options.

TCP Configuration

See: TCP Configuration

TCP Syslog Configuration

  • Syslog Facility
    • A numeric value in the range of 0 - 23 (inclusive).
    • Defined in Section 6.2.1 of the Syslog specification.
  • Syslog Severity
    • A numeric value in the range of 0 - 7 (inclusive).
    • Defined in Section 6.2.1 of the Syslog specification.

Add a Frame Delimiter

The TCP Syslog output supports 3 different frame delimiters:

  1. Octet Counting: Messages are prefixed with the length of the message (RFC6587)

  2. Null Character: Messages are delimited by a \0 byte

  3. Newline Character: Messages are delimited by an \n character

The default is Null Character. Please check the frame delimiting method in your output configuration. Most syslog servers can use Newline Character or Octet Counting.