Syslog

Syslog receivers use a dedicated TCP/TLS endpoint. Production does not accept Syslog over UDP or plain TCP.

Prerequisites

Create a Syslog receiver, add the sender’s public IPv4 or CIDR to its source rules, and wait until the endpoint is active. Copy its exact hostname and assigned port.

rsyslog

Create /etc/rsyslog.d/98-fluxtail.conf using your exact receiver values:

global(DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")

action(
  type="omfwd"
  target="YOUR_POOL_HOSTNAME"
  port="YOUR_ASSIGNED_PORT"
  protocol="tcp"
  StreamDriver="gtls"
  StreamDriverMode="1"
  StreamDriverAuthMode="x509/name"
  StreamDriverPermittedPeers="YOUR_POOL_HOSTNAME"
  TCP_Framing="octet-counted"
  template="RSYSLOG_SyslogProtocol23Format"
  action.resumeRetryCount="-1"
  queue.type="LinkedList"
  queue.filename="fluxtail"
  queue.saveOnShutdown="on"
)

Check, restart, and send a known message:

sudo rsyslogd -N1
sudo systemctl restart rsyslog
logger -t fluxtail-test "Fluxtail Syslog test"

Verify

Open the receiver’s stream in Live Tail and search for Fluxtail Syslog test.

Troubleshooting

• Confirm the endpoint is active.
• Confirm the sender’s public IPv4 matches a source rule.
• Confirm outbound TCP to the assigned port is allowed.
• Test TLS without disabling verification:

openssl s_client \
  -connect YOUR_POOL_HOSTNAME:YOUR_ASSIGNED_PORT \
  -servername YOUR_POOL_HOSTNAME \
  -verify_hostname YOUR_POOL_HOSTNAME

Fluxtail accepts RFC 3164 and RFC 5424 with persistent TCP framing.

Next steps

Check parsed host, application, severity, and message fields with search and filters, then tune the disk queue for the sender’s reliability needs. See rsyslog’s official omfwd module documentation for forwarding and queue options.