SYLO.CONF

NAME

sylo.conf - sylo(1) configuration file

DESCRIPTION

The sylo.conf file is the main configuration file for the sylo (1) which ensures the reliable delivery of syslog messages over the network using TCP as transfer protocoll. This includes spooling all syslog messages using a disk based queue called silo.

For a detailed description for how the sylo works take a look at the sylo (1) man page.

BASIC STRUCTURE

Lines starting with a hash mark ('#') or a semicolon (';') and empty lines are ignored.

The sylo.conf file consists of sections, led by a [section] header and followed by name = value entries. Note that leading whitespaces are removed from values. The optional values can contain format strings which refer to other values in the same section.

If some values are commented out or not given in the configuration file the hardcoded options in sylo (1) will be used.

The following sections should be available in the configuration file:

Gerneral

The General section contains program wide options.

Source

The Source section contains options which are related to the source side of sylo which receives the log messages from the local syslog service.

Target

The Target sections contains options which are related to the target side of sylo which sends the log messages over the network to the remote syslog server.

OPTIONS

[General]

daemon_user

User to start run the daemon with.

If not set the current user will be used.

Default:

daemon_group

Group to start run the daemon with.

If not set the current group will be used.

Default:

spool_dir

The directory where the silo file and silo hint file are searched and created in. It needs to be read and writeable by the user executing the sylo.

Default: /var/spool/sylo

spool_size

The spool size defines the size of the log silo on the disk. The size of the silo is fixed to "reserve" the needed space for the logs. The silo will never grow or shrink except when the size is changed in the configuration file.

When the size in the configuration file is changed the sylo tries to resize the silo. This is only possible when the silo is completely empty.

The size can be given in bytes as plain integer or with the following suffixes:

K Give the size in kilobytes
M Give the size in megabytes
G Give the size in gigabytes

For example a valid size is: 150M for a fixed silo size of 150 megabytes.

Default: 200M

delete_old

This option is used when the silo is full and one additional message needs to be added to the silo. When set to True messages in the silo are delted to get free space for the new messages. The deletion begins at the oldest message.

When set to False the new messages are thrown away as long as there is no space for the arriving messages in the silo.

Default: False

flush_on_write

If it is really, really important to have all the messages stored instant on the disk a flush operation should be performed after each write operation.

If set to True the written bytes are flushed after each write operation. When set to False the bytes are flushed automatically by the filesystem.

Be aware: Enabling this option may be very I/O intensive and may slow down your system.

Default: False

log_level

This option controlls the verbosity of the sylo daemon while logging. The levels are named like the syslog verbosities. The daemon will print out all log entries which are equal or worse the configured verbosity.

Available Levels:

Debug
Informational
Notice
Warning
Error
Critical
Alert
Emergency

Not all of the levels are used at the moment but this may change in future versions.

Default: Informational

log_file

File to write the daemon logging entries to. The daemon does not use syslog itselfs to prevent race conditions.

Default: /var/log/sylo

log_size_limit

This parameter gives the internal logfile a size limit. The log size is checked on each new log entry. If the size limit is reached a suffix .old will be added to the current log file. Then the new logfile is being created.

With this mechanism you should have a little more than twice of this limit space available on the volume you store this log.

Default: 100M

max_msg_size

In one special case it may possible to loose one message: When the silo has no more space for a message but the message has been read from the pipe. Once the sylo is shut down without storing the message in the silo the message gets lost.

This defines the maximum size of a message where the sylo ensures that there will be no data loss when transfering the message from the incoming pipe to the silo. Using this static message size the sylo can check if there is enough space in the silo before reding the message from the pipe.

In most cases it's not a problem to have larger messages than defined here but it can not be guaranteed that these messages don't get lost.

The size can be given in bytes as plain integer or with the following suffixes:

K Give the size in kilobytes
M Give the size in megabytes
G Give the size in gigabytes

For example a valid size is: 2K for a fixed silo size of 2 kiobytes.

Default: 1K

alive_report

This option defines the interval in seconds where the threads are checked for being alive. Alive means that the thread is active and has not being terminated for some reason. On each alive check a log entry is written to the log of the sylo. Setting this option to "0" disables the alive report.

The alive check also touches the silo.hint file for making the monitoring easy.

Default: 60

[Source]

start

Set to True to let the daemon start the source thread for fetching logs from the pipe. When set to False the source thread will not be started. This means that no new logs are read from the pipe and no additional logs will be added to the silo.

Default: True

pipe

To make the incoming side of th sylo work it is mandatory to set the correct path to the pipe where the local syslog daemon sends the logs to.

The logs to be sent to this pipe need to be in a special format which is described below in the chapter LOGFORMAT.

Default: /var/run/sylo.pipe

pipe_user

Name of the user to be the owner of the incoming pipe. If an empty string is given the current user is being used.

If the pipe exists the user will be changed to the configured value.

Default:

pipe_group

Name of the group to be the owner of the incoming pipe. If an empty string is given the current users primary group is being used.

If the pipe exists the group will be changed to the configured value.

Default:

pipe_mode

Mask to create the incoming pipe with.

If the pipe exists the mode will be changed to the configured value.

Default: 600

pipe_retry

Defines the interval in seconds where the source thread retries connecting to the pipe when there was some problem with the pipe before.

If set to "0" the daemon terminates when the pipe could not be opened.

Default: 10

[Target]

start

Set to True to let the daemon start the target thread for fetching logs from the pipe. When set to False the target thread will not be started. This means that no new logs are read from the pipe and no additional logs will be added to the silo.

Default: True

destinations

Defines the destinatios the target thread needs to send the logs in the silo to. There can be one or multiple destinations separated by comma (',').

The destinations must be efined in the following format:

<protocol>:<address>:<port>

At the moment there is only one protocol supported: tcp

The address can be given as ip-address or fqdn (full qualified domain name).

The port needs to be set as numeric value of 1 to 65535.

At the given destinations a process speaking the syslog protocol must listen. The listening process needs to be able to handle an extended rfc3164 version of the syslog protocol like for example rsyslog or syslog-ng are able to. This is described in detail in the LOGFORMAT section.

Default: tcp:127.0.0.1:514

multi_dest_mode

This option controls the behaviour of the target thread when there are stated multiple destinations.

The following modes are available at the moment:

one Send the logs only to one of the given destinations. The destinations are proceeded in the given order. If the message has been submitted to one of the given destinations it terminates the delivery of that message and marks it as delivered. The log won't be send to any other destination.

Default: one

LOGFORMAT

... TODO ...

FILES

/etc/sylo.conf

Configuration file for sylo.

SEE ALSO

Please visit the official sylo homepage (http://sylo.mathias-kettner.de/) for additional information.

AUTHORS

Lars Michelsen <lm@mathias-kettner.de>