platforms / syslog / caveats

Syslog Caveats

There are a few caveats to be aware of when forwarding logs from syslog using this method:

  1. Timber Agent requires that the data it receives be terminated with new lines; if the syslog format you are using terminates log lines with NULL bytes, the Agent will crash. This is why the example above creates a modified version of the RSYSLOG_ForwardFormat which uses a new line (\n).
  2. The signalOnClose parameter is only available for rsyslog version 8.23.0 (released November 15, 2016) and above. If you are using an earlier version, you can remove this parameter. The Timber agent will shutdown anyways when rsyslog stops forwarding data; using signalOnClose simply ensures that it shuts down sooner.
Questions?

Chat with us, just click the talk button in the bottom right of this page.

Chat with us
Sign Up

Log better and solve problems faster, today. Install in under a minute.

Sign Up