Module syslog 

Available on non-WebAssembly only.

Access-log lines to a syslog server (18.33.0, #102): RFC 5424 messages over UDP, TCP (octet-counting framing, RFC 6587 §3.4.1) or a Unix datagram socket such as /dev/log.

RWS_CONFIG_ACCESS_LOG_SYSLOG = udp://host:514, tcp://host:6514 or unix:///dev/log; RWS_CONFIG_ACCESS_LOG_SYSLOG_FACILITY = local0 (default) … local7, or another facility name or number. Read once, at the first access-log line. Lines go to syslog as well as stdout or the access-log file, in the configured RWS_CONFIG_LOG_FORMAT (JSON is what SIEMs parse best), severity info, APP-NAME rws, MSGID access.

Nothing is sent from the request path: the access-log sink hands each flushed batch (every 100 ms) to a queue that the thread rws-syslog sends. While the server is unreachable batches wait up to MAX_QUEUED bytes, then are dropped (counted by dropped_lines); a TCP connection is re-made on the next batch.

Structs

Sender

Sends access-log batches to one syslog Target.

Enums

Target

Where messages go.

Constants

MAX_QUEUED

Bytes of unsent lines kept while the server is unreachable.

RWS_CONFIG_ACCESS_LOG_SYSLOG

RWS_CONFIG_ACCESS_LOG_SYSLOG: where to send access-log lines.

RWS_CONFIG_ACCESS_LOG_SYSLOG_FACILITY

RWS_CONFIG_ACCESS_LOG_SYSLOG_FACILITY: the syslog facility (default local0).

Functions

dropped_lines

Lines dropped because the queue was full.

flush_now

Send what is queued now, on this thread (at process exit).

message

Append one RFC 5424 message for line to out: <PRI>1 TIMESTAMP HOSTNAME rws PROCID access - LINE.

parse_facility

A facility name (kern, user, … local0–local7) or number 0–23.

sender

The configured sender, if RWS_CONFIG_ACCESS_LOG_SYSLOG is set; its thread starts with the first call.