<commit_before>// Module included in the following assemblies:
//
// * logging/cluster-logging-external.adoc

[id="cluster-logging-collector-legacy-syslog_{context}"]
= Forwarding logs using the legacy syslog method

You can use the *syslog* RFC3164 protocol to send logs to destinations outside of your {product-title} cluster instead of the default Elasticsearch log store by creating a configuration file and config map. You are responsible for configuring the external log aggregator to receive the logs from {product-title}.

[IMPORTANT]
====
This method for forwarding logs is deprecated in {product-title} and will be removed in a future release.
====

There are two versions of the *syslog* protocol:

* *out_syslog*: The non-buffered implementation, which communicates through UDP, does not buffer data and writes out results immediately.
* *out_syslog_buffered*: The buffered implementation, which communicates through TCP and link:https://docs.fluentd.org/buffer[buffers data into chunks].

To send logs using the *syslog* protocol, create a configuration file called `syslog.conf`, with the information needed to forward the logs. Then, use that file to create a config map called `syslog` in the `openshift-logging` project, which {product-title} uses when forwarding the logs.

.Sample syslog configuration file
[source,yaml]
----
<store>
@type syslog_buffered
remote_syslog rsyslogserver.example.com
port 514
hostname ${hostname}
remove_tag_prefix tag
facility local0
severity info
use_record true
payload_key message
rfc 3164
</store>
----

You can configure the following `syslog` parameters. For more information, see the syslog link:https://tools.ietf.org/html/rfc3164[RFC3164].

* facility: The link:https://tools.ietf.org/html/rfc3164#section-4.1.1[syslog facility]. The value can be a decimal integer or a case-insensitive keyword:
** `0` or `kern` for kernel messages
** `1` or `user` for user-level messages, the default.
** `2` or `mail` for the mail system
** `3` or `daemon` for the system daemons
** `4` or `auth` for the security/authentication messages
** `5` or `syslog` for messages generated internally by syslogd
** `6` or `lpr` for the line printer subsystem
** `7` or `news` for the network news subsystem
** `8` or `uucp` for the UUCP subsystem
** `9` or `cron` for the clock daemon
** `10` or `authpriv` for security authentication messages
** `11` or `ftp` for the FTP daemon
** `12` or `ntp` for the NTP subsystem
** `13` or `security` for the syslog audit logs
** `14` or `console` for the syslog alert logs
** `15` or `solaris-cron` for the scheduling daemon
** `16`–`23` or `local0` – `local7` for locally used facilities
* payloadKey: The record field to use as payload for the syslog message.
* rfc: The RFC to be used for sending log using syslog.
* severity: The link:https://tools.ietf.org/html/rfc3164#section-4.1.1[syslog severity] to set on outgoing syslog records. The value can be a decimal integer or a case-insensitive keyword:
** `0` or `Emergency` for messages indicating the system is unusable
** `1` or `Alert` for messages indicating action must be taken immediately
** `2` or `Critical` for messages indicating critical conditions
** `3` or `Error` for messages indicating error conditions
** `4` or `Warning` for messages indicating warning conditions
** `5` or `Notice` for messages indicating normal but significant conditions
** `6` or `Informational` for messages indicating informational messages
** `7` or `Debug` for messages indicating debug-level messages, the default
* tag: The record field to use as tag on the syslog message.
* trimPrefix: The prefix to remove from the tag.

.Procedure

To configure {product-title} to forward logs using the legacy configuration methods:

. Create a configuration file named `syslog.conf` and specify parameters similar to the following within the `<store>` stanza:
+
----
<store>
@type <type> <1>
remote_syslog <syslog-server> <2>
port 514 <3>
hostname <host> <4>
remove_tag_prefix <prefix> <5>
facility <value>
severity <value>
use_record <value>
payload_key message
rfc 3164 <6>
</store>
----
<1> Specify the protocol to use, either: `syslog` or `syslog_buffered`.
<2> Specify the FQDN or IP address of the syslog server.
<3> Specify the port of the syslog server.
<4> Specify a name for this syslog server.
<5> Optional. Specify the appropriate syslog parameters, for example:
** Parameter to  remove the specified `tag` field from the syslog prefix.
** Parameter to set the specified field as the syslog key.
** Parameter to specify the syslog log facility or source.
** Parameter to specify the syslog log severity.
** Parameter to use the severity and facility from the record if available. If `true`, the `container_name`, `namespace_name`, and `pod_name` are included in the output content.
** Parameter to specify the key to set the payload of the syslog message. Defaults to `message`.
<6> Specify the RFC protocol to use: `3164`.

. Create a config map named `syslog` in the `openshift-logging` project from the configuration file:
+
[source,terminal]
----
$ oc create configmap syslog --from-file=syslog.conf -n openshift-logging<commit_msg>RHDEVDOCS-2604 Wrong value and definition for legacy syslog hostname<commit_after>// Module included in the following assemblies:
//
// * logging/cluster-logging-external.adoc

[id="cluster-logging-collector-legacy-syslog_{context}"]
= Forwarding logs using the legacy syslog method

You can use the *syslog* RFC3164 protocol to send logs to destinations outside of your {product-title} cluster instead of the default Elasticsearch log store by creating a configuration file and config map. You are responsible for configuring the external log aggregator to receive the logs from {product-title}.

[IMPORTANT]
====
This method for forwarding logs is deprecated in {product-title} and will be removed in a future release.
====

There are two versions of the *syslog* protocol:

* *out_syslog*: The non-buffered implementation, which communicates through UDP, does not buffer data and writes out results immediately.
* *out_syslog_buffered*: The buffered implementation, which communicates through TCP and link:https://docs.fluentd.org/buffer[buffers data into chunks].

To send logs using the *syslog* protocol, create a configuration file called `syslog.conf`, with the information needed to forward the logs. Then, use that file to create a config map called `syslog` in the `openshift-logging` project, which {product-title} uses when forwarding the logs.

.Sample syslog configuration file
[source,yaml]
----
<store>
@type syslog_buffered
remote_syslog rsyslogserver.example.com
port 514
hostname ${hostname}
remove_tag_prefix tag
facility local0
severity info
use_record true
payload_key message
rfc 3164
</store>
----

You can configure the following `syslog` parameters. For more information, see the syslog link:https://tools.ietf.org/html/rfc3164[RFC3164].

* facility: The link:https://tools.ietf.org/html/rfc3164#section-4.1.1[syslog facility]. The value can be a decimal integer or a case-insensitive keyword:
** `0` or `kern` for kernel messages
** `1` or `user` for user-level messages, the default.
** `2` or `mail` for the mail system
** `3` or `daemon` for the system daemons
** `4` or `auth` for the security/authentication messages
** `5` or `syslog` for messages generated internally by syslogd
** `6` or `lpr` for the line printer subsystem
** `7` or `news` for the network news subsystem
** `8` or `uucp` for the UUCP subsystem
** `9` or `cron` for the clock daemon
** `10` or `authpriv` for security authentication messages
** `11` or `ftp` for the FTP daemon
** `12` or `ntp` for the NTP subsystem
** `13` or `security` for the syslog audit logs
** `14` or `console` for the syslog alert logs
** `15` or `solaris-cron` for the scheduling daemon
** `16`–`23` or `local0` – `local7` for locally used facilities
* payloadKey: The record field to use as payload for the syslog message.
* rfc: The RFC to be used for sending log using syslog.
* severity: The link:https://tools.ietf.org/html/rfc3164#section-4.1.1[syslog severity] to set on outgoing syslog records. The value can be a decimal integer or a case-insensitive keyword:
** `0` or `Emergency` for messages indicating the system is unusable
** `1` or `Alert` for messages indicating action must be taken immediately
** `2` or `Critical` for messages indicating critical conditions
** `3` or `Error` for messages indicating error conditions
** `4` or `Warning` for messages indicating warning conditions
** `5` or `Notice` for messages indicating normal but significant conditions
** `6` or `Informational` for messages indicating informational messages
** `7` or `Debug` for messages indicating debug-level messages, the default
* tag: The record field to use as tag on the syslog message.
* trimPrefix: The prefix to remove from the tag.

.Procedure

To configure {product-title} to forward logs using the legacy configuration methods:

. Create a configuration file named `syslog.conf` and specify parameters similar to the following within the `<store>` stanza:
+
----
<store>
@type <type> <1>
remote_syslog <syslog-server> <2>
port 514 <3>
hostname ${hostname}
remove_tag_prefix <prefix> <4>
facility <value>
severity <value>
use_record <value>
payload_key message
rfc 3164 <5>
</store>
----
<1> Specify the protocol to use, either: `syslog` or `syslog_buffered`.
<2> Specify the FQDN or IP address of the syslog server.
<3> Specify the port of the syslog server.
<4> Optional: Specify the appropriate syslog parameters, for example:
** Parameter to  remove the specified `tag` field from the syslog prefix.
** Parameter to set the specified field as the syslog key.
** Parameter to specify the syslog log facility or source.
** Parameter to specify the syslog log severity.
** Parameter to use the severity and facility from the record if available. If `true`, the `container_name`, `namespace_name`, and `pod_name` are included in the output content.
** Parameter to specify the key to set the payload of the syslog message. Defaults to `message`.
<5> With the legacy syslog method, you must specify `3164` for the `rfc` value.

. Create a config map named `syslog` in the `openshift-logging` project from the configuration file:
+
[source,terminal]
----
$ oc create configmap syslog --from-file=syslog.conf -n openshift-logging
{'fraction_non_alphanumeric': 0.09435235158057055, 'fraction_numerical': 0.018118735543562067, 'mean_word_length': 4.8461971830985915, 'pattern_counts': {'":': 0, '<': 48, '<?xml version=': 0, '>': 48, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '525367', 'n_tokens_mistral': 3059, 'n_tokens_neox': 2921, 'n_words': 1390}