Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

External link updates #85

Merged
merged 4 commits into from
Nov 20, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@ weight: 1300
---
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

Multiple {{% param "product.abbrev" %}} servers can be run in fail-over mode. The {{% param "product.abbrev" %}} application does not include any internal support for this, as clustering support must be implemented on the operating system level. A tool that can be used to create UNIX clusters is Heartbeat (for details, see [this page](http://www.linux-ha.org/wiki/Main_Page/)).
Multiple {{% param "product.abbrev" %}} servers can be run in fail-over mode. The {{% param "product.abbrev" %}} application does not include any internal support for this, as clustering support must be implemented on the operating system level.

Starting with {{% param "product.name" %}} version 3.2, {{% param "product.abbrev" %}} clients can be configured to send the log messages to failover servers in case the primary syslog server becomes unaccessible. For details on configuring failover servers, see the description of the `failover-servers()` destination option in {{% xref "/chapter-destinations/_index.md" %}}.
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ weight: 300
---
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

This section describes the `HEADER` message part of a syslog message, according to the [legacy-syslog or BSD-syslog protocol](https://tools.ietf.org/search/rfc3164).
This section describes the `HEADER` message part of a syslog message, according to the [legacy-syslog or BSD-syslog protocol](https://datatracker.ietf.org/doc/rfc3164/).

For further details about the `MSG` and `PRI` parts of a syslog message, see the following sections:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ weight: 500
---
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

This section describes the `MSG` message part of a syslog message, according to the [legacy-syslog or BSD-syslog protocol](https://tools.ietf.org/search/rfc3164).
This section describes the `MSG` message part of a syslog message, according to the [legacy-syslog or BSD-syslog protocol](https://datatracker.ietf.org/doc/rfc3164/).

For further details about the `HEADER` and `PRI` message parts of a syslog message, see the following sections:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ weight: 100
---
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

This section describes the `PRI` message part of a syslog message, according to the [legacy-syslog or BSD-syslog protocol](https://tools.ietf.org/search/rfc3164).
This section describes the `PRI` message part of a syslog message, according to the [legacy-syslog or BSD-syslog protocol](https://datatracker.ietf.org/doc/rfc3164/).

For further details about the `HEADER` and `MSG` parts of a syslog message, see the following sections:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ The following is a very simple configuration file for `syslog-ng`: it collects t
};
```

As a `syslog-ng` user described on a [mailing list](https://lists.gt.net/gentoo/user/209108):
As a `syslog-ng` user described on a mailing list:
fekete-robert marked this conversation as resolved.
Show resolved Hide resolved

> Alan McKinnon
>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ short_description: "Publish messages using AMQP"
---
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

The `amqp()` driver publishes messages using the [AMQP (Advanced Message Queuing Protocol)](http://www.amqp.org/). {{% param "product.abbrev" %}} supports AMQP versions 0.9.1 and 1.0. The {{% param "product.abbrev" %}} `amqp()` driver supports persistence, and every available exchange types.
The `amqp()` driver publishes messages using the [AMQP (Advanced Message Queuing Protocol)](https://en.wikipedia.org/wiki/Advanced_Message_Queuing_Protocol). {{% param "product.abbrev" %}} supports AMQP versions 0.9.1 and 1.0. The {{% param "product.abbrev" %}} `amqp()` driver supports persistence, and every available exchange types.

The name-value pairs selected with the `value-pairs()` option will be sent as AMQP headers, while the body of the AMQP message is empty by default (but you can add custom content using the `body()` option). Publishing the name-value pairs as headers makes it possible to use the Headers exchange-type and subscribe only to interesting log streams. This solution is more flexible than using the `routing-key()` option.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,6 @@ The following example send messages to Elasticsearch over HTTP using its REST AP

- For the list of options, see {{% xref "/chapter-destinations/configuring-destinations-elasticsearch2/reference-destination-elasticsearch2/_index.md" %}}.

The `elasticsearch2()` driver is actually a reusable configuration snippet configured to receive log messages using the Java language-binding of {{% param "product.abbrev" %}}. For details on using or writing such configuration snippets, see {{% xref "/chapter-configuration-file/large-configs/config-blocks/_index.md" %}}. You can find the source of the elasticsearch configuration snippet on [GitHub](https://github.com/axoflow/axosyslog/blob/master/scl/elasticsearch/plugin.conf). For details on extending {{% param "product.abbrev" %}} in Java, see the [Getting started with syslog-ng development](https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/section_2.html) guide.
The `elasticsearch2()` driver is actually a reusable configuration snippet configured to receive log messages using the Java language-binding of {{% param "product.abbrev" %}}. For details on using or writing such configuration snippets, see {{% xref "/chapter-configuration-file/large-configs/config-blocks/_index.md" %}}. You can find the source of the elasticsearch configuration snippet on [GitHub](https://github.com/axoflow/axosyslog/blob/main/scl/elasticsearch/elastic-http.conf).

{{< include-headless "wnt/note-jvm-reload.md" >}}
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ weight: 700

## Purpose:

Version 3.9 and later supports the [Search Guard](https://floragunn.com/searchguard/) Elasticsearch plugin (version 2.4.1.16 and newer) to encrypt and authenticate your connections to from {{% param "product.abbrev" %}} to Elasticsearch 2 and newer. To configure {{% param "product.abbrev" %}} to send messages to an Elasticsearch 2.x cluster that uses Search Guard, complete the following steps.
Version 3.9 and later supports the [Search Guard](https://search-guard.com/) Elasticsearch plugin (version 2.4.1.16 and newer) to encrypt and authenticate your connections to from {{% param "product.abbrev" %}} to Elasticsearch 2 and newer. To configure {{% param "product.abbrev" %}} to send messages to an Elasticsearch 2.x cluster that uses Search Guard, complete the following steps.

To connect to an Elasticsearch 5.x or newer cluster, use HTTPS mode.

Expand All @@ -21,7 +21,7 @@ To connect to an Elasticsearch 5.x or newer cluster, use HTTPS mode.
sudo /usr/share/elasticsearch/bin/plugin install -b com.floragunn/search-guard-ssl/<version-number-of-the-plugin>
```

2. Create a certificate for your {{% param "product.abbrev" %}} host, and add the certificate to the `SYSLOG_NG-NODE_NAME-keystore.jks` file. You can configure the location of this file in the Elasticsearch resources file under the `path.conf` parameter. For details, see the [Search Guard documentation](https://github.com/floragunncom/search-guard-ssl-docs/blob/master/certificates.md).
2. Create a certificate for your {{% param "product.abbrev" %}} host, and add the certificate to the `SYSLOG_NG-NODE_NAME-keystore.jks` file. You can configure the location of this file in the Elasticsearch resources file under the `path.conf` parameter. For details, see the [Search Guard documentation](https://docs.search-guard.com/latest/configuring-tls#using-keystore-and-truststore-files).

3. Configure an Elasticsearch destination in {{% param "product.abbrev" %}} that uses the `searchguard` client mode. For example:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,6 @@ The following example defines an `hdfs` destination using only the required para

- For the list of options, see {{% xref "/chapter-destinations/configuring-destinations-hdfs/reference-destination-hdfs/_index.md" %}}.

The `hdfs()` driver is actually a reusable configuration snippet configured to receive log messages using the Java language-binding of {{% param "product.abbrev" %}}. For details on using or writing such configuration snippets, see {{% xref "/chapter-configuration-file/large-configs/config-blocks/_index.md" %}}. You can find the source of the hdfs configuration snippet on [GitHub](https://github.com/axoflow/axosyslog/blob/master/scl/hdfs/plugin.conf). For details on extending {{% param "product.abbrev" %}} in Java, see the [Getting started with syslog-ng development](https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/section_2.html) guide.
The `hdfs()` driver is actually a reusable configuration snippet configured to receive log messages using the Java language-binding of {{% param "product.abbrev" %}}. For details on using or writing such configuration snippets, see {{% xref "/chapter-configuration-file/large-configs/config-blocks/_index.md" %}}. You can find the source of the hdfs configuration snippet on [GitHub](https://github.com/axoflow/axosyslog/blob/master/scl/hdfs/plugin.conf).

{{< include-headless "wnt/note-jvm-reload.md" >}}
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,6 @@ The following example defines a `kafka` destination, using only the required par

- For the list of options, see {{% xref "/chapter-destinations/configuring-destinations-kafka/reference-destination-kafka/_index.md" %}}.

The `kafka()` driver is actually a reusable configuration snippet configured to receive log messages using the Java language-binding of {{% param "product.abbrev" %}}. For details on using or writing such configuration snippets, see {{% xref "/chapter-configuration-file/large-configs/config-blocks/_index.md" %}}. You can find the source of the kafka configuration snippet on [GitHub](https://github.com/axoflow/axosyslog/blob/master/scl/kafka/plugin.conf). For details on extending {{% param "product.abbrev" %}} in Java, see the [Getting started with syslog-ng development](https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/section_2.html) guide.
The `kafka()` driver is actually a reusable configuration snippet configured to receive log messages using the Java language-binding of {{% param "product.abbrev" %}}. For details on using or writing such configuration snippets, see {{% xref "/chapter-configuration-file/large-configs/config-blocks/_index.md" %}}. You can find the source of the kafka configuration snippet on [GitHub](https://github.com/axoflow/axosyslog/blob/main/scl/kafka/kafka.conf).

{{< include-headless "wnt/note-jvm-reload.md" >}}
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ The `mongodb()` destination has the following options:

Available in {{% param "product_name" %}} version 4.3.0 and newer.

*Description:* Enables [bulk insert](http://mongoc.org/libmongoc/current/bulk.html) mode. If disabled, each messages is inserted individually.
*Description:* Enables [bulk insert](https://mongoc.org/libmongoc/current/mongoc_bulk_operation_insert.html) mode. If disabled, each messages is inserted individually.

> Note: Bulk sending is only efficient if you use a constant [collection](#mongodb-option-collection) (without templates), or the used template does not lead to too many collections switching within a reasonable time range.

Expand All @@ -41,7 +41,7 @@ Available in {{% param "product_name" %}} version 4.3.0 and newer.

Available in {{% param "product_name" %}} version 4.3.0 and newer.

*Description:* Enables [unordered bulk operations](http://mongoc.org/libmongoc/current/bulk.html) mode.
*Description:* Enables [unordered bulk operations](http://mongoc.org/libmongoc/1.23.3/bulk.html) mode.

## collection() {#mongodb-option-collection}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,6 @@ Note that the time format parameter requires:

In older versions of riemann-c-client, the microseconds option is not available.

In case your distribution does not contain a recent enough version of riemann-c-client and you wish to use microseconds, install a new version from [](https://github.com/algernon/riemann-c-client).

If you installed the new version in a custom location (instead of the default one), make sure that you append the directory of the pkg-config file (`.pc` file) to the environment variable `export PKG_CONFIG_PATH=...`.

After calling `configure`, you should see the following message in the case of successful installation:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ short_description: "Send messages to Telegram"

The `telegram()` destination sends log messages to [Telegram](https://core.telegram.org/ "https://core.telegram.org"), which is a secure, cloud-based mobile and desktop messaging app.

Note that this destination automatically uses the certificate store of the system (for details, see the [curl documentation](https://curl.haxx.se/sslcerts.html)).
Note that this destination automatically uses the certificate store of the system (for details, see the [curl documentation](https://curl.se/docs/sslcerts.html)).


## Declaration:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ short_description: "Send metrics to collectd"
---
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

The `collectd()` destination uses the [unixsock plugin of the collectd application](https://collectd.org/documentation/manpages/collectd-unixsock.5.shtml) to send log messages to the [collectd system statistics collection daemon](https://collectd.org). You must install and configure collectd separately before using this destination.
The `collectd()` destination uses the [unixsock plugin of the collectd application](https://www.collectd.org/documentation/manpages/collectd-unixsock.html) to send log messages to the [collectd system statistics collection daemon](https://collectd.org). You must install and configure collectd separately before using this destination.

Available in {{% param "product.abbrev" %}} version 3.20 and later.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ The `collectd()` destination has the following options. The `plugin()` and `type
| Type: | path |
| Default: | /var/run/collectd-unixsock |

*Description:* The path to the socket of collectd. For details, see the [collectd-unixsock(5) manual page](https://collectd.org/documentation/manpages/collectd-unixsock.5.shtml).
*Description:* The path to the socket of collectd. For details, see the [collectd-unixsock(5) manual page](https://www.collectd.org/documentation/manpages/collectd-unixsock.html).

```shell
type("gauge"),
Expand All @@ -105,7 +105,7 @@ The `collectd()` destination has the following options. The `plugin()` and `type
| Type: | string or template |
| Default: | |

*Description:* Identifies the type and number of values passed to collectd. For details, see the [types.db manual page](https://collectd.org/documentation/manpages/types.db.5.shtml). For example:
*Description:* Identifies the type and number of values passed to collectd. For details, see the [types.db manual page](https://www.collectd.org/documentation/manpages/types.db.html). For example:

```shell
type("gauge"),
Expand Down
2 changes: 1 addition & 1 deletion content/chapter-destinations/destination-slack/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ The `slack()` destination driver sends messages to a [Slack](https://slack.com/)
```


The driver allows you to modify nearly every field of the HTTP request. For details, see the [Slack API documentation](https://api.slack.com/message-attachments).
The driver allows you to modify nearly every field of the HTTP request. For details, see the [Slack API documentation](https://api.slack.com/docs).

{{% include-headless "chunk/destination-http-proxy-settings.md" %}}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ The `slack` destination of {{% param "product.abbrev" %}} can directly post log
| Type: | string or template |
| Default: | 'host: ${HOST} | program: ${PROGRAM}(${PID}) | severity: ${PRIORITY}' |

*Description:* The sender of the message as displayed in Slack. For details, see the [author_name option in the Slack documentation](https://api.slack.com/message-attachments).
*Description:* The sender of the message as displayed in Slack. For details, see the [author_name option in the Slack documentation](https://api.slack.com/reference/surfaces/formatting#attachments).



Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ The {{% param "product.abbrev" %}} application can convert the syslog messages s

To accomplish this, {{% param "product.abbrev" %}} has to use a special pattern database to parse the Cisco-specific syslog messages, because these messages do not comply with the standard syslog formats.

For details on the Cisco-specific SNMP trap format, see [CISCO-SYSLOG-MIB](http://tools.cisco.com/ITDIT/MIBS/servlet/index) on the Cisco website.
For details on the Cisco-specific SNMP trap format, see [CISCO-SYSLOG-MIB](https://github.com/cisco/cisco-mibs/blob/main/schema/CISCO-SYSLOG-MIB.schema).


## Parsing Cisco-specific message fields with patterndb
Expand Down
2 changes: 1 addition & 1 deletion content/chapter-enrich-data/geoip-parser/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ The {{% param "product.abbrev" %}} application can lookup IPv4 addresses from an

{{% alert title="Note" color="info" %}}

To access longitude and latitude information, download the [GeoLiteCity](http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz) database, and unzip it (for example, to the `/usr/share/GeoIP/GeoLiteCity.dat` file). The default databases available on Linux and other platforms usually contain only the country codes.
To access longitude and latitude information, download the [GeoLite2City](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data/) database, and unzip it (for example, to the `/usr/share/GeoIP/GeoLiteCity.dat` file). The default databases available on Linux and other platforms usually contain only the country codes.

{{% /alert %}}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@ The name of the package depends on the Linux distribution. The package mentioned

The resulting dump file will contain the keys that you can use.

For a more complete list of keys, you can also check the [GeoIP2 City and Country CSV Databases](https://dev.maxmind.com/geoip/geoip2/geoip2-city-country-csv-databases/). However, note that the {{% param "product.abbrev" %}} application works with the `mmdb` (GeoIP2) format of these databases. Other formats, like `csv` are not supported.
For a more complete list of keys, you can check the [GeoIP Databases of MaxMind](https://dev.maxmind.com/geoip/). However, note that the {{% param "product.abbrev" %}} application works with the `mmdb` (GeoIP2) format of these databases. Other formats, like `csv` are not supported.
Loading
Loading