Syslog

Introduction

Syslog O11ySource to onboard and monitor Syslog-based log streams into vuSmartMaps. It listens on a configured ingress node (Syslog server IP/FQDN and port), receives Syslog messages (currently supports RFC3164), parses and enriches them, and ingests normalized logs for search, dashboards, and alerting. Currently, only UDP transport is supported.

Getting Started

Compatibility

The Syslog O11ySource is compatible with all system logs and network device logs.

Data Collection Method

vuSmartMaps collects syslogs through a data collector deployed within the vuSmartMaps platform.

Prerequisites

Inputs for Configuring Data Source

• Server: Enter the IP address or fully qualified domain name (FQDN) of a vuSmartMaps ingress node that will receive Syslog traffic. This value uniquely identifies the ingress node entry in the system and is used as the primary key to distinguish each server you add.
• Protocol: Select UDP as the transport protocol for receiving Syslog data.

Firewall Requirement

To collect data from this O11ySource, ensure the following ports are opened:

Source IP	Destination IP	Destination Port	Protocol	Direction
IP address of the device	vuSmartMaps Collection/Ingress node IP	5514*	UDP	Inbound

*Before providing the firewall requirements, please update the port based on the customer environment.

Configuring the Target

Users must configure their system to send Syslog data to vuSmartMaps ingress nodes.

Configuration Steps

• Enable the Syslog O11ySource.
• Select the sources tab and press the + button to add a new instance that has to be monitored.
• Provide the required configurations:
• *Server
• *Transport Protocol
• Click Save to close the data source window.

Metrics Collected

Name	Description	Data Type
Timestamp	Timestamp at metricsets collected	DateTime
Facility Code	Used to categorize log messages based on their sources or purposes	UInt16
Message	nan	String
ProcID	Provides the process name or process ID associated with a syslog system	String
Severity Code	Codes range from 0 to 7, with each level representing a different severity	UInt8
AppName	Identifies the name of the application or process that generated the log entry.	String
Facility	Used to specify the type or source of the log message	String
Host	Host IP of incoming log	String
HostName	Host Name of incoming log	String
Log Severity	Indicates the seriousness or urgency of a log message	LowCardinality(String)
Message Lower	nan	String
Log UUID	nan	UUID
Network Type	nan	String