How to Configure and Use Syslog and Serilog Sinks?

Syslog Configuration

Recommended Tools:

  • Visual Syslog Server (recommended)

  • Syslog Watcher Manager (Note: Has a limit of 5000 messages/hour)

Configuration Steps:

Currently, we support Syslog (UDP) using the RFC5424 Output format for external logger configuration.

To visualize MetaDefender Storage Security audit logs centrally, integrate a Syslog (UDP) server using these details:

  • Server address: IPv4, IPv6, and Host Name formats supported.

  • Port: Specified Syslog server port.

  • Syslog Facility: As per configuration needs.

  • Output format: RFC5424.

You can add up to 5 external logger configurations of each type.

Syslog Message Format

RFC5424 message format is supported:

<PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID STRUCTURED-DATA MSG

  • PRI: Priority value

  • VERSION: Syslog protocol specification version

  • TIMESTAMP: Formalized timestamp

  • HOSTNAME: Sending machine

  • APP-NAME: Application or device originating message

  • PROCID: Process name or ID

  • MSGID: Message type

  • STRUCTURED-DATA: Parsable data format

  • MSG: Informative free-form message

Example Syslog Message

<110>1 2024-03-26T12:27:58.276724+02:00 LP10-D8569 MetaDefenderStorageSecurity 36800 - [meta UserName="jdavis" UserId="e69e8c2d-4dcc-4489-8f40-0df84199de52" EventTimestamp="03/26/2024 10:27:58" Category="3" LogType="600"] John Davis (jdavis) logged in.

What is Serilog?

Serilog is a structured logging library for .NET applications, which allows logging to various destinations called sinks, including Syslog, files, HTTP endpoints, and console.

Commonly Used Serilog Sinks and Configurations:

  1. Serilog.Sinks.Syslog

Logs events to remote syslog servers via UDP or TCP, supporting RFC3164 and RFC5424 formats.

"WriteTo": [ { "Name": "TcpSyslog", "Args": { "host": "<ip_host>", "port": 514, "appName": "<your_app_name>", "format": "RFC5424", "facility": "<facility_name>", "outputTemplate": "[{Timestamp:u}] [{Level}] {SourceContext}: {Message:lj}{NewLine}{Exception}" } } ]

  1. Serilog.Sinks.Http

Sends log events via HTTP/S to remote endpoints.

"WriteTo": [ { "Name": "Http", "Args": { "requestUri": "<your_request_uri>", "queueLimitBytes": null } } ]

  1. Serilog.Sinks.Console

Writes log events to the console.

"WriteTo": [ { "Name": "Console", "Args": { "outputTemplate": "[{Timestamp:u}] [{Level}] {Namespace}: {Message:lj}{NewLine}{Exception}" } } ]

  1. Serilog.Sinks.File

Writes logs to a file.

"WriteTo": [ { "Name": "File", "Args": { "buffered": false, "fileSizeLimitBytes": 500000000, "outputTemplate": "[{Timestamp:u}] [{Level}] {Namespace}: {Message:lj}{NewLine}{Exception}", "path": "logs/log.txt", "retainedFileCountLimit": "10", "rollingInterval": "Day", "rollOnFileSizeLimit": true } } ]

Testing & Validation:

Use tools like Visual Syslog Server or test HTTP endpoints to validate your logging configurations and ensure logs are captured correctly.

Support:

If Further Assistance is required, please proceed to log a support case or chatting with our support engineer.


Next to read:
Does MetaDefender Storage Security support symlinks scanning?
null
On This Page
How to Configure and Use Syslog and Serilog Sinks?Syslog ConfigurationSerilog SinksTesting & Validation:Recommended Tools:Configuration Steps:Syslog Message FormatExample Syslog MessageWhat is Serilog?Commonly Used Serilog Sinks and Configurations: