8

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do:

error_log syslog:server=192.168.1.1;

However I need to redirect to a specific TCP (not UDP!) port and I tried with:

error_log syslog:server=192.168.1.1:3000;

but it doesn't pass through. How can specify to Nginx that the port should be TCP and not UDP?

Many thanks!

int 2Eh
  • 193
  • 1
  • 2
  • 6
  • 1
    I guess, nginx cannot log to syslog via TCP. – Alexey Ten Apr 14 '16 at 11:18
  • 2
    Logging to anything TCP is a horrible idea. The reason is if that server is down each connection into nginx will be blocked waiting for the tcp connection to be made. Also TCP is slower then UDP so when its up you are adding latency into nginx. UDP is fire and forget. It doesn't wait for a handshake – Mike Apr 14 '16 at 12:23
  • 3
    You could setup syslog on localhost that will listen to UDP (or even unix socket) and send logs to remote server. – Alexey Ten Apr 14 '16 at 12:58

2 Answers2

2

There is no way to send via TCP in this way, which is quite a common way to send logs on a network, since you want the message delivery to be reliable (look at the RELP module for evidence of that need).

But also, only being able to send logs via UDP is quite common, a number of network devices (switches or routers for example) are only capable of sending by UDP, so sending to a syslog gateway could be a solution, if you're not able to add a listener on the syslog server on the port you want. That would receive your UDP logs, and send them on to your central server via TCP instead.

Myself I would look to collect the logs on the nginx server with rsyslog and forward them on to the central server instead of relying on nginx to do all the work. You can chose the protocol and port to send to.

Rumbles
  • 994
  • 1
  • 12
  • 28
1

You can send it to udp and then run socat on 192.168.1.1 

socat UDP4-RECVFROM:192.168.1.1:3000,fork,reuseaddr TCP4-SENDTO:192.168.1.1:3000
Victor Zhuravlyov
  • 11
  • 2