Syslog-ng

Mezmo ingests syslog-ng data through an OpenTelemetry (OTel) Collector placed between your syslog-ng hosts and Mezmo. syslog-ng forwards logs to the Collector’s syslog receiver over TCP+TLS, TCP, or UDP, and the Collector relays them to Mezmo’s OpenTelemetry Source with the otlphttp exporter. The Collector’s syslog receiver accepts the syslog-ng default format, RFC 5424 and RFC 3164, for auto parsing.

syslog-ng (destination)  -->  OpenTelemetry Collector (syslog receiver)  -->  Mezmo OTEL Source (otlphttp exporter)

Set Up the OpenTelemetry Collector

Log in to the Mezmo Web App, create (or open) a Pipeline, and add an OpenTelemetry Source. Note the ingestion key — you’ll use it as apikey.
Download the otelcol-contrib distribution, which includes the syslog receiver, from the OpenTelemetry website.
Create a config.yaml:

receivers:
  syslog:
    protocol: rfc5424
    tcp:
      listen_address: "0.0.0.0:514"
      # tls:
      #   cert_file: /path/to/cert.pem
      #   key_file: /path/to/key.pem

exporters:
  otlphttp/mezmo:
    endpoint: "https://logs.mezmo.com/otel"
    compression: gzip
    headers:
      apikey: "<YOUR_INGESTION_KEY>"

service:
  pipelines:
    logs:
      receivers: [syslog]
      exporters: [otlphttp/mezmo]

Uncomment the tls block to require TCP+TLS, or replace the tcp block with a udp block to accept UDP instead.

Start the Collector:

./otelcol-contrib --config /path/to/config.yaml

Point syslog-ng at the Collector

Configure syslog-ng’s destination to send to the host and port where the Collector’s syslog receiver is listening, instead of directly to Mezmo.

If possible, we highly recommend setting up a keepalive inside your syslog-ng forwarding configuration. This helps make sure that bad connections are properly terminated and re-initiated, and increases the reliability of log delivery. You can learn about rsyslog/syslog-ng keepalive options here.

syslog-ng TCP+TLS with Custom Port Settings

destination d_otelcol {
  tcp("<OTEL_COLLECTOR_HOST>" port(CUSTOM-PORT-NUMBER)
    tls(peer-verify(required-trusted) ca_dir("/etc/ssl/certs")));
};
log {
  source(s_src);
  destination(d_otelcol);
};
### END syslog-ng OTel Collector logging directives ###

syslog-ng TCP with Custom Port Settings

destination d_otelcol {
  tcp("<OTEL_COLLECTOR_HOST>" port(CUSTOM-PORT-NUMBER));
};
log {
  source(s_src); ### this could be (s_sys) for RedHat/CentOS
  destination(d_otelcol);
};
### END syslog-ng OTel Collector logging directives ###

syslog-ng UDP

destination d_otelcol {
  udp("<OTEL_COLLECTOR_HOST>" port(CUSTOM-PORT-NUMBER));
};
log {
  source(s_src); ### this could be (s_sys) for RedHat/CentOS
  destination(d_otelcol);
};
### END syslog-ng OTel Collector logging directives ###

Tagging Hosts

Authentication now happens between the Collector and Mezmo, via the apikey header on the otlphttp exporter, rather than being embedded in each syslog-ng line. As a result, the legacy logdna@48950 STRUCTURED-DATA tagging format is no longer needed. To group or tag hosts, add a processor (such as an attributes or resource processor) to your Collector’s logs pipeline, and use fields the syslog receiver already extracts from RFC 5424/3164 messages, such as HOSTNAME and APP-NAME, to set attributes for grouping in Mezmo.

⌘I

Overview

Ingest Logs

Manage Log Lines

View and Analyze Logs

Alerts

Account and Organization Management

Mezmo MCP and AI

Integrations

Other Topics

Set Up the OpenTelemetry Collector

Point syslog-ng at the Collector

syslog-ng TCP+TLS with Custom Port Settings

syslog-ng TCP with Custom Port Settings

syslog-ng UDP

Tagging Hosts

​Set Up the OpenTelemetry Collector

​Point syslog-ng at the Collector

​syslog-ng TCP+TLS with Custom Port Settings

​syslog-ng TCP with Custom Port Settings

​syslog-ng UDP

​Tagging Hosts

Set Up the OpenTelemetry Collector

Point syslog-ng at the Collector

syslog-ng TCP+TLS with Custom Port Settings

syslog-ng TCP with Custom Port Settings

syslog-ng UDP

Tagging Hosts