This section describes the options of the nodejs() source in syslog-ng OSE.

The nodejs() driver has the following options.

chain-hostname()

Type: yes, no
Default: no

Description: This option can be used to enable or disable the chained hostname format. For more information, see the chain-hostnames() global option.

format()

Synopsis: format(string)
Default: syslog

Description: This option specifies the default message parsing format used by syslog-ng OSE. Plugins can define their own format parsers; if a plugin does not provide one, the default syslog format parser is used.

You can also define and explicitly use a custom parser separately, for example, in Python. For more information, see syslog parser.

hook-commands()

Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.

NOTE: The syslog-ng OSE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng OSE to execute external applications.

Using the hook-commands() when syslog-ng OSE starts or stops

To execute an external program when syslog-ng OSE starts or stops, use the following options:

startup()

Type: string
Default: N/A

Description: Defines the external program that is executed as syslog-ng OSE starts.

shutdown()

Type: string
Default: N/A

Description: Defines the external program that is executed as syslog-ng OSE stops.

Using the hook-commands() when syslog-ng OSE reloads

To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:

setup()

Type: string
Default: N/A

Description: Defines an external program that is executed when the syslog-ng OSE configuration is initiated, for example, on startup or during a syslog-ng OSE reload.

teardown()

Type: string
Default: N/A

Description: Defines an external program that is executed when the syslog-ng OSE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng OSE reload.

Example: Using the hook-commands() with a network source

In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically as syslog-ng OSE is started/stopped.

The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng OSE created rule is there, packets can flow, otherwise the port is closed.

source {
    network(transport(udp)
        hook-commands(
          startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
          shutdown("iptables -D LOGCHAIN 1")
        )
      );
};

internal()

Description: To collect warnings, errors and notices from syslog-ng OSE itself, include this source in one of your source statements.

Example format in configuration:

source s_local { internal(); };

For more details, see internal: Collecting internal messages.

ip() or localip()

Type: string
Default: 0.0.0.0

Description: The IP address to bind to. By default, syslog-ng OSE listens on every available interface. Note that this is not the address where messages are accepted from.

If you specify a multicast bind address and use the udp transport, syslog-ng OSE automatically joins the necessary multicast group. TCP does not support multicasting.

normalize-hostnames()

Type: yes, no
Default: no

Description: If this option is set to yes (normalize-hostnames(yes)), syslog-ng OSE converts the hostnames to lowercase. This setting only applies to hostnames resolved from DNS. It has no effect if the keep-hostname() option is enabled, and the message contains a hostname. | Accepted values: | yes | no| |Default: |no|

NOTE: This setting applies only to hostnames resolved from DNS. It has no effect if the keep-hostname() option is enabled, and the message contains a hostname.

port() or localport()

Type: number
Default: 9003

Description: The port number to bind to.

sdata-prefix()

Type: string
Default: .SDATA.

Available in syslog-ng OSE 4.1 and later versions.

Description: Adds a specific string before the names of the parsed SDATA fields to store the name-value pairs created from the SDATA fields separately. Note that unless the value of sdata-prefix starts with .SDATA., using this option excludes the parsed fields from the sdata and rfc5424 scopes of the value pairs.

use-syslogng-pid()

Accepted values: yes, no
Default: no

Description: If this parameter is set to yes, syslog-ng OSE fills the value of the ${PID} macro with its own process ID.

Updated: