Syslog-ng

You can stream RSyslog logs using TCP+TLS, TCP, and UDP, as well as through custom syslog ports. Mezmo accepts the Rsyslog default format, RFC 5424 and RFC 3164 for auto parsing.

In 2022, we changed the company name from LogDNA to Mezmo. However, the IANA-approved Private Enterprise Number (PEN), 48950, is still associated with the name LogDNA. We continue to use this name in our code examples for simplicity.

Set Up Syslog-ng Log Ingestion

Follow the instructions in the Mezmo Web App to set up RSyslog log ingestion using your Mezmo syslog port and ingestion key.

Log in to the Mezmo Web App.
In the bottom section of the left-hand navigation, click Help.
Select Add Log Sources.
Under Via syslog, click syslog-ng.
Follow the instructions to set up Syslog-ng log ingestion.

Host Tags

Host tags let you group hosts automatically without having to explicitly assign a host to a group within the Mezmo web app. Host tags follow the syslog RFC-defined STRUCTURED-DATA format and require configuring the template line in /etc/rsyslog.d/22-logdna.conf to include the IANA-approved LogDNA Private Enterprise Number (PEN), 48950. For example:

$template LogDNAFormat,"<%PRI%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [logdna@48950 key=\"YOUR-INGESTION-KEY-HERE\" tags=\"tag1,tag2\"] %msg%"

This will send up lines from with the host tags prod and web, which would add this host to the prod and web tags.

If possible, we highly recommend setting up a keepalive inside your syslog forwarding configuration. This helps make sure that bad connections are properly terminated and re-initiated, and increases the reliability of log delivery. You can learn about rsyslog keepalive options here.

Configuration Examples

Syslog-ng TCP+TLS with Custom Port Settings

template LogDNAFormat { template("<${PRI}>1 ${ISODATE} ${HOST} ${PROGRAM} ${PID} ${MSGID} [logdna@48950 tags=\"ANY-TAG,COMMA-SEPERATED\"] $MSG\n"); ## Remove the "tags" if not being used above.`` template_escape(no);``};``destination d_logdna {`` tcp("syslog-a.logdna.com" port(CUSTOM-PORT-NUMBER)`` tls(peer-verify(required-untrusted) ca_dir("/etc/ld-root-ca.crt"))`` template(LogDNAFormat));``};``log {`` source(s_src);`` destination(d_logdna);``};``### END syslog-ng LogDNA logging directives ###

TCP with Custom Port Settings

template LogDNAFormat { template("<${PRI}>1 ${ISODATE} ${HOST} ${PROGRAM} ${PID} ${MSGID} [logdna@48950 tags=\"ANY-TAG,COMMA-SEPERATED\"] $MSG\n"); ## Remove the "tags" if not being used above.`` template_escape(no);``};``destination d_logdna {`` tcp("syslog-a.logdna.com" port(CUSTOM-PORT-NUMBER)`` template(LogDNAFormat));``};``log {`` source(s_src); ### this could be (s_sys) for RedHat/Centos`` destination(d_logdna);``};``log {`` source(s_src);`` destination(d_logdna);``};``### END syslog-ng LogDNA logging directives ###

TCP+TLS Default Port

template LogDNAFormat { template("<${PRI}>1 ${ISODATE} ${HOST} ${PROGRAM} ${PID} ${MSGID} [logdna@48950 key=\"YOURAPIKEY\"] $MSG\n");`` template_escape(no);``};`` ``destination d_logdna {`` tcp("syslog-a.logdna.com" port(6514)`` tls(peer-verify(required-untrusted) ca_dir("LOCATIONOFCERTIFICATE"))`` template(LogDNAFormat));``};`` ``log {`` source(s_src); ### this could be (s_sys) for RedHat/Centos`` destination(d_logdna);``};

TCP Default Port

template LogDNAFormat { template("<${PRI}>1 ${ISODATE} ${HOST} ${PROGRAM} ${PID} ${MSGID} [logdna@48950 key=\"YOURAPIKEY\"] $MSG\n");`` template_escape(no);``};`` ``destination d_logdna {`` tcp("syslog-a.logdna.com" port(514)`` template(LogDNAFormat));``};`` ``log {`` source(s_src); ### this could be (s_sys) for RedHat/Centos`` destination(d_logdna);``};``log {`` source(s_src);`` destination(d_logdna);``};

UDP Default Port

template LogDNAFormat { template("<${PRI}>1 ${ISODATE} ${HOST} ${PROGRAM} ${PID} ${MSGID} [logdna@48950 key=\"YOURAPIKEY\"] $MSG\n");`` template_escape(no);``};``destination d_logdna {`` udp("syslog-u.logdna.com" port(514)`` template(LogDNAFormat));``};``log {`` source(s_src); ### this could be (s_sys) for RedHat/Centos`` destination(d_logdna);``};``log {`` source(s_src);`` destination(d_logdna);``};`

Syslog

Windows Security Template

⌘I

Overview

Ingest Logs

Manage Log Lines

View and Analyze Logs

Alerts

Account and Organization Management

Mezmo MCP and AI

Integrations

Other Topics

Set Up Syslog-ng Log Ingestion

Host Tags

Configuration Examples

Syslog-ng TCP+TLS with Custom Port Settings

TCP with Custom Port Settings

TCP+TLS Default Port

TCP Default Port

UDP Default Port

​Set Up Syslog-ng Log Ingestion

​Host Tags

​Configuration Examples

​Syslog-ng TCP+TLS with Custom Port Settings

​TCP with Custom Port Settings

​TCP+TLS Default Port

​TCP Default Port

​UDP Default Port

Set Up Syslog-ng Log Ingestion

Host Tags

Configuration Examples

Syslog-ng TCP+TLS with Custom Port Settings

TCP with Custom Port Settings

TCP+TLS Default Port

TCP Default Port

UDP Default Port