Struct SyslogSink 

pub struct SyslogSink { /* private fields */ }

Forwards each event to the local syslog daemon via libc::syslog.

Unix-only (#[cfg(unix)]) — Windows has no syslog equivalent (Event Log / ETW are a different API surface). Windows callers should use FileSink and ship the file to whatever ingest the host runs.

Each call to emit invokes libc::syslog(priority, "%s", line) where priority is LOG_INFO | LOG_USER. The libc client takes care of socket-path portability (/dev/log on Linux, /var/run/syslog on macOS) and RFC3164/5424 framing — we don’t reimplement either.

Process-singleton constraint

openlog(3) / closelog(3) mutate process-global state in the libc syslog client — a second openlog call replaces the first connection’s ident, and closelog tears down the connection for every holder. To avoid cross-close hazards, this type deliberately:

1. Leaks the ident CString (Box::leak) so the pointer openlog retained stays valid for the process lifetime, and
2. Does not implement Drop (no closelog call).

Construct at most one SyslogSink per process. The CLI does exactly this via resolve_audit_sink(). Library consumers that need a second syslog destination should wrap an existing Arc<SyslogSink> rather than calling SyslogSink::open again.

Implementations

impl SyslogSink

pub fn open(ident: &str) -> Result<Self>

Open a syslog connection with ident (program name shown in log entries). Default priority: LOG_INFO | LOG_USER.

Returns Err only if ident contains an interior NUL. The underlying openlog(3) is infallible — it does not perform I/O until the first syslog(3) call.

Trait Implementations

impl AuditSink for SyslogSink

Available on Unix only.

fn emit(&self, event: &AuditEvent)

impl Debug for SyslogSink

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.