Syslog

Introduction

Syslog O11ySource to onboard and monitor Syslog-based log streams into vuSmartMaps. It listens on a dedicated vuSmartMaps ingress node and receives Syslog messages from network devices and systems. Supports RFC3164 (BSD Syslog) and RFC5424 (Structured Syslog) over UDP, and RFC5424 over TCP (internal forwarders, no TLS support).

Getting Started

Compatibility

The Syslog O11ySource is compatible with all system logs and network device logs.

Data Collection Method

vuSmartMaps collects syslogs through a data collector deployed within the vuSmartMaps platform.

Infrastructure Requirement — Node Designation The telemetry receiver pod must be pinned to a dedicated Kubernetes node so that all devices can send to a stable, known IP. This is a one-time setup performed by the infrastructure team.

Run once on the target node: kubectl label node <node-name> telemetry-receiver=True kubectl taint node <node-name> telemetry-receiver=True:NoSchedule

Once labeled, the pod is automatically scheduled to that node and all listeners start on boot. No UI configuration is required.

Prerequisites

Inputs for Configuring Data Source

• Source Device: IP address or FQDN of the source device.
• Syslog Standard: Select the RFC standard and transport your device use. This determines which port your device must be configured to send to: 5514 for RFC3164/UDP (legacy routers, switches, firewalls), 5515 for RFC5424/UDP (modern Linux rsyslog/syslog-ng), 5516 for RFC5424/TCP (internal log forwarders without TLS).

Firewall Requirement

To collect data from this O11ySource, ensure the following ports are opened:

Source IP	Destination IP	Destination Port	Protocol	Direction
IP address of the source device/system sending Syslog	IP address of the vuSmartMaps telemetry-receiver node	5514	UDP [RFC3164 (legacy: routers, switches, firewalls)]	Inbound
IP address of the source device/system sending Syslog	IP address of the vuSmartMaps telemetry-receiver node	5515	UDP [RFC5424 (modern: Linux rsyslog, syslog-ng)]	Inbound
IP address of the source device/system sending Syslog	IP address of the vuSmartMaps telemetry-receiver node	5516	TCP [RFC5424 (modern: Linux rsyslog, syslog-ng)]	Inbound

*Before providing the firewall requirements, please update the port based on the customer environment.

Configuring the Target

Configure your device or system to forward Syslog traffic to the vuSmartMaps ingress node IP on the port that matches the standard your device supports: Port 5514 — RFC3164 / UDP (legacy network devices: routers, switches, Cisco IOS) Port 5515 — RFC5424 / UDP (modern systems: Linux rsyslog, syslog-ng) Port 5516 — RFC5424 / TCP (internal log forwarders, no TLS — use within trusted network only)

The ingress node IP is the IP of the Kubernetes node labeled 'telemetry-receiver=True'. Contact your infrastructure team if you are unsure which node to use.

Configuration Steps

• Enable the Syslog O11ySource.
• Select the sources tab and press the + button to add a new instance.
• Provide the required configurations:
• *Host: IP address or FQDN of the source device.
• *Syslog Standard: Select the RFC standard your devices use (RFC3164/UDP → port 5514, RFC5424/UDP → port 5515, RFC5424/TCP → port 5516). All listeners are always active — this selection tells you which port to configure on your device.
• *Applications: Select the applications this syslog data belongs to.
• Click Save to close the data source window.

Metrics Collected

Name	Description	Data Type
Timestamp	Timestamp when the syslog message was received	DateTime
Facility Code	Numeric code categorizing the log source (0=kernel, 1=user, 3=daemon…)	UInt16
Message	Full syslog message content as received	String
ProcID	Process name or PID associated with the syslog message	String
Severity Code	Numeric severity level (0=Emergency … 7=Debug)	UInt8
AppName	Name of the application or process that generated the log entry	String
Facility	Human-readable facility name (e.g. kern, daemon, local7)	String
Host	Source IP address of the device that sent the syslog message	String
HostName	Hostname reported inside the syslog message payload	String
Log Severity	Human-readable severity label (Emergency, Alert, Critical…)	LowCardinality(String)
Message Lower	Lowercase copy of the message field for case-insensitive search	String
Log UUID	Unique identifier assigned to each log entry at ingest time	UUID
Network Type	Network type tag enriched at ingest (e.g. LAN, WAN)	String
Syslog RFC	RFC standard used to parse the incoming message (RFC3164 or RFC5424), emitted as a Telegraf tag	LowCardinality(String)