Syslog

Syslog receivers use a dedicated TCP/TLS endpoint. Production does not accept Syslog over UDP or plain TCP.

Prerequisites

Create a Syslog receiver, add the sender’s public IPv4 or CIDR to its source rules, and wait until the endpoint is active. Copy its exact hostname and assigned port.

rsyslog

Create /etc/rsyslog.d/98-fluxtail.conf using your exact receiver values:

global(DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")

action(
  type="omfwd"
  target="YOUR_POOL_HOSTNAME"
  port="YOUR_ASSIGNED_PORT"
  protocol="tcp"
  StreamDriver="gtls"
  StreamDriverMode="1"
  StreamDriverAuthMode="x509/name"
  StreamDriverPermittedPeers="YOUR_POOL_HOSTNAME"
  TCP_Framing="octet-counted"
  template="RSYSLOG_SyslogProtocol23Format"
  action.resumeRetryCount="-1"
  queue.type="LinkedList"
  queue.filename="fluxtail"
  queue.saveOnShutdown="on"
)

Check, restart, and send a known message:

sudo rsyslogd -N1
sudo systemctl restart rsyslog
logger -t fluxtail-test "Fluxtail Syslog test"

Verify

Open the receiver’s stream in Live Tail and search for Fluxtail Syslog test.

Troubleshooting

• Confirm the endpoint is active.
• Confirm the sender’s public IPv4 matches a source rule.
• Confirm outbound TCP to the assigned port is allowed.
• Test TLS without disabling verification:

openssl s_client \
  -connect YOUR_POOL_HOSTNAME:YOUR_ASSIGNED_PORT \
  -servername YOUR_POOL_HOSTNAME \
  -verify_hostname YOUR_POOL_HOSTNAME

Fluxtail accepts RFC 3164 and RFC 5424 with persistent TCP framing.