Syslog

Introduction

Syslog O11ySource to onboard and monitor Syslog-based log streams into vuSmartMaps. It listens on configured ingress ports, receives Syslog messages (supports RFC5424, RFC3164, and common Cisco variations), parses and enriches them, and ingests normalized logs for search, dashboards, and alerting. UDP, TCP, and TLS transports are supported, and custom grok patterns can be added and shared across all configured protocol listeners.

Getting Started

Compatibility

The Syslog O11ySource is compatible with system logs and network device logs delivered over UDP, TCP, or TLS.

Data Collection Method

vuSmartMaps collects syslogs through a data collector deployed within the vuSmartMaps platform.

Infrastructure Requirement — Node Designation The Syslog receiver pod must be pinned to a dedicated Kubernetes node so that all devices can send to a stable, known IP. This is a one-time setup performed by the infrastructure team.

Run once on the target node: kubectl label node <node-name> syslog-receiver=True kubectl taint node <node-name> syslog-receiver=True:NoSchedule

Once labeled, the pod is automatically scheduled to that node and all listeners start on boot. No UI configuration is required.

Prerequisites

Dependent Configuration

To configure this O11ySource, create a 'credential' of type 'tls_certificate_bundle' under the 'Definition' tab.

Inputs for Configuring Data Source

• Listener Source Identifier: Provide a unique name for this Syslog listener. This identifier cannot be changed after the source is created.
• Listener Protocol: Select the listener transport. UDP and TCP use port 5514. TLS uses port 6514.
• TLS Credential: Select the TLS certificate bundle credential used by the Syslog TLS listener.
• Grok Pattern Phrase: Add one or more custom grok patterns. Each added grok pattern is shared across all configured UDP, TCP, and TLS listeners.
• Grok Pattern: Enter a custom grok pattern for syslog parsing.

Firewall Requirement

To collect data from this O11ySource, ensure the following ports are opened:

Source IP	Destination IP	Destination Port	Protocol	Direction
IP address of the device	vuSmartMaps Collection/Ingress node IP	5514 (UDP,TCP) / 6514 (TLS)	UDP / TCP / TLS	Inbound

*Before providing the firewall requirements, please update the port based on the customer environment.

Configuring the Target

Users must configure their system to send Syslog data to vuSmartMaps ingress nodes. TCP and TLS senders must use octet-counting framing. TLS alone requires a TLS credential. Any custom grok patterns configured in the UI are applied across all rendered UDP, TCP, and TLS listeners.

TLS Credential Requirement When Listener Protocol is set to TLS, create and select a tls_certificate_bundle credential under the Definitions tab. The credential configuration dynamically requires the applicable files based on the selected role and TLS mode:

Server role TLS or mTLS: CA certificate, server certificate, and server private key.

Client role TLS: CA certificate only. mTLS: CA certificate, client certificate, and client private key.

Configuration Steps

• Enable the Syslog O11ySource.
• Select the sources tab and press the + button to add a new instance that has to be monitored.
• Provide the required configurations:
• *Listener Protocol
• *TLS Credential (shown only for TLS)
• *Optional Grok Pattern Phrase entries
• Use port 5514 for UDP, or port 6514 for TCP/TLS.
• For TCP/TLS senders, octet-counting framing is applied automatically.
• Each added grok pattern is reused across all configured protocol listeners.
• Click Save to close the data source window.

Metrics Collected

Name	Description	Data Type
Timestamp	Timestamp at metricsets collected	DateTime
Facility Code	Used to categorize log messages based on their sources or purposes	UInt16
Message	nan	String
ProcID	Provides the process name or process ID associated with a syslog system	String
Severity Code	Codes range from 0 to 7, with each level representing a different severity	UInt8
AppName	Identifies the name of the application or process that generated the log entry.	String
Facility	Used to specify the type or source of the log message	String
Host	Host IP of incoming log	String
HostName	Host Name of incoming log	String
Log Severity	Indicates the seriousness or urgency of a log message	LowCardinality(String)
Message Lower	Stores the log message content in lowercase format for normalized processing and search.	String
Log UUID	Unique identifier assigned to each log record.	UUID
Network Type	Indicates the network type associated with the incoming log.	String
Extra Fields	Additional fields from the incoming Syslog message.	String