There are a few caveats to be aware of when forwarding logs from syslog using this method:
- Timber Agent requires that the data it receives be terminated with new lines; if the syslog format you are using terminates log lines with NULL bytes, the Agent will crash. This is why the example above creates a modified version of the
RSYSLOG_ForwardFormatwhich uses a new line (
signalOnCloseparameter is only available for rsyslog version 8.23.0 (released November 15, 2016) and above. If you are using an earlier version, you can remove this parameter. The Timber agent will shutdown anyways when rsyslog stops forwarding data; using
signalOnClosesimply ensures that it shuts down sooner.