[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573787-105":53,"doc-detail-573787-en":125},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":118,"head_meta":120,"extra_data":122,"updated_unix":124},105,"en","syslog-cheat-sheet-v12-quick-reference","Syslog Cheat Sheet - v1.2 - quick reference","","Syslog Cheat Sheet (v1.2) provides a practical cross-reference for configuring centralized log collection using syslog-ng and rsyslog. It lists common syslog-ng variables for host, IP, priority, facility, tags, program name, and received/message timestamps. It also includes example configuration blocks for remote sources, firewall filtering by netmask, output routing into per-host/day log files, and performance tuning such as queue sizing, flush behavior, and module inputs. Supplemental permission and SELinux steps are included to support directory access and port binding.",{"@graph":63,"@context":117},[64,80,100],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/syslog-cheat-sheet-v12-quick-reference/573787/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":94,"encodingFormat":93,"isAccessibleForFree":95,"interactionStatistic":96},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/syslog-cheat-sheet-v12-quick-reference/573787.png","ImageObject",442,249,{"name":88,"@type":89},"River Wang","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-14",true,{"@type":97,"interactionType":98,"userInteractionCount":9},"InteractionCounter",{"@type":99},"ViewAction",{"@type":101,"mainEntity":102},"FAQPage",[103,109,113],{"name":104,"@type":105,"acceptedAnswer":106},"Which syslog fields are covered by the common variables list?","Question",{"text":107,"@type":108},"It covers sending host and source IP, priority and facility text, tags, program name, and both received time and message time using variables like $HOST, $SOURCEIP, $PRIORITY, $FACILITY, $TAGS, $PROGRAM, ${R_DATE}, and ${DATE}.","Answer",{"name":110,"@type":105,"acceptedAnswer":111},"How does the document demonstrate separating remote syslog streams from firewall logs?",{"text":112,"@type":108},"It defines different sources and routes them through dedicated rulesets. A firewall filter example selects messages based on a specified netmask and then writes results to a dedicated firewall log destination.",{"name":114,"@type":105,"acceptedAnswer":115},"What performance and deployment adjustments are included beyond basic routing?",{"text":116,"@type":108},"It includes performance tuning such as main_queue sizing and flush/time_reap settings. It also provides operational steps for POSIX ACLs and SELinux context/port permissions to make remote log directories and ports work correctly.","https://schema.org",{"og:url":78,"og:type":119,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":121,"canonical":78},"index,follow",{"doc_id":123,"site_id":56},573787,1792015937,{"code":4,"msg":5,"data":126},{"doc_id":123,"user_id":127,"nickname":88,"user_avatar":128,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":129,"file_id":130,"file_url":131,"file_type":132,"file_size":133,"view_count":9,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":73,"language":134,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":135,"faqs":136,"seo_title":137,"seo_description":61,"update_tm":138,"read_time":9},1099514067438,"https://ap-avatar.wpscdn.com/avatar/100002539ee87300030?x-image-process=image/resize,m_fixed,w_180,h_180&k=1780474512215547542","| Syslog Cheat Sheet (v1.2)\u003Cbr>[https://www.aplura.com/cheatsheets](https://www.aplura.com/cheatsheets) |  |  |  |  |  |  |  |  |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| Syslog-ng Common |  |  |  | Variables Rsyslog |  |  |  |  |\n| Sending host |  | $HOST |  | Sending host |  |  | fromhost |  |\n| Sending host IP |  | $SOURCEIP |  | Sending host IP |  |  | fromhost-ip |  |\n| Priority text |  | $PRIORITY |  | Priority text |  |  | pri-text |  |\n| Facility text |  | $FACILITY |  | Facility text |  |  | syslogfacility-text |  |\n| Tag |  | $TAGS |  | Tag |  |  | syslogtag |  |\n| Program name |  | $PROGRAM |  | Program name |  |  | programname |  |\n| Time received |  | ${R_DATE} |  | Time received |  |  | timegenerated |  |\n| Message time |  | ${DATE} |  | Message time |  |  | timereported |  |\n| syslog-ng parameters |  |  |  | rsyslog properties |  |  |  |  |\n| Setup |  |  |  | Listeners |  |  |  |  |\n| source s_remote_all {\u003Cbr>udp ( ip( \"[0.0.0.0](0.0.0.0) \" ) port(514) );\u003Cbr>tcp ( ip( \"[0.0.0.0](0.0.0.0) \" ) port(514) ); };\u003Cbr>source s_firewall {\u003Cbr>udp ( ip( \"[0.0.0.0](0.0.0.0) \" ) port(1514) ); tcp ( ip( \"[0.0.0.0](0.0.0.0) \" ) port(1514) ); }; |  |  |  | input(type=\"imudp\" port=\"514\" ruleset=\"f_remote_all\")\u003Cbr>input(type=\"imtcp\" port=\"514\" ruleset=\"f_remote_all\")\u003Cbr>input(type=\"imudp\" port=\"1514\" ruleset=\"f_firewall\")\u003Cbr>input(type=\"imtcp\" port=\"1514\" ruleset=\"f_firewall\") |  |  |  |  |\n| Filters ( |  |  |  | Optional) |  |  |  |  |\n| \\# Syslog-ng filters are defined separately and used within the log statement\u003Cbr>filter f_firewall_range {\u003Cbr>netmask ([192.168.100.0/](192.168.100.0/)[255.255.255.0](255.255.255.0) ); }; |  |  |  | \\# Rsyslog filters go within the Output ruleset if ($fromhost-ip startswith '192 .168 .100 .')\u003Cbr>then { action(type=\"omfile\"\u003Cbr>DynaFile=\"d_firewall_log\")\u003Cbr>}\u003Cbr>Rsyslog Expressions\u003Cbr>Rsyslog Control Structures |  |  |  |  |\n| Syslog-ng Filter Options |  |  | gray, italicized items are optional |  |  |  |  |  |\n|  |  |  | Organize Direc | tories by Host |  |  |  |  |\n| destination d_catch_all { file(\"/var/log/remote_syslog/ catch_all/$HOST/$YEAR-$MONTH-$DAY.log\"); };\u003Cbr>destination d_firewall_log { file(\"/var/log/\u003Cbr>remote_syslog/firewall/$HOST/$YEAR-$MONTH-$DAY.log\"); }; |  |  |  | template(name=\"d_catch_all\" type=\"string\" string=\"/var/ log/remote_syslog/catch_all/%FROMHOST%/%$YEAR%-%$MONTH%-%$DAY%.log\")\u003Cbr>template(name=\"d_firewall_log\" type=\"string\" string=\"/var/ log/remote_syslog/firewall/%FROMHOST%/%$YEAR%-%$MONTH%-%$DAY%.log\") |  |  |  |  |\n| Set Output |  |  |  |  |  |  |  |  |\n| log { source(s_remote_all); |  |  |  | ruleset(name= \"f_remote_all \" ) { |  |  |  |  |\n| destination(d_catch_all); }; |  |  |  | action(type= \"omfile \" DynaFile= \"d_catch_all \" ) } |  |  |  |  |\n| log { source(s_firewall); filter(f_firewall_range); |  |  |  | ruleset(name=“f_firewall”) { |  |  |  |  |\n| destination(d_firewall_log); }; |  |  |  | action(type= \"omfile \" DynaFile= \"d_firewall_log \" ) } |  |  |  |  |\n| Performan |  |  |  | ce Tuning |  |  |  |  |\n| options {\u003Cbr>log_fifo_size (10000);\u003Cbr>time_reap(20); |  |  |  | main_queue(\u003Cbr>queue .size=\"1000000\" \\# Size of Queue\u003Cbr>queue.debatchsize=\"1000\" \\# process messages in batches queue.workerthreads=\"2\" \\# 2 threads for the queue |  |  |  |  |\n| flush_lines(10000); |  |  |  | ) |  |  |  |  |\n| flush_timeout(1000); }; |  |  |  |  |  |  |  |  |\n| syslog_ng_tuning |  |  |  | rsyslog_tuning |  |  |  |  |\n| Permi |  |  |  | ssions |  |  |  |  |\n| POSIX ACLs | chmod g+s /var/log/remote_syslog/ |  |  |  | Set the SUID bit |  |  |  |\n|  | setfacl -R -d -m g:splunk:rx /var/log/remote_syslog/ |  |  |  | Set the default permissions |  |  |  |\n|  | setfacl -R -m g:splunk:rx /var/log/remote_syslog/ |  |  |  | Set the current permissions |  |  |  |\n|  | setfacl -R -x g:splunk:rx /var/log/remote_syslog/ |  |  |  | Remove POSIX permissions |  |  |  |\n|  | chmod g-s /var/log/remote_syslog/ |  |  |  | Remove SUID bit |  |  |  |\n| SELINUX | chcon system_u:obje","cbCaiob5ZIemd21C","https://ap.wps.com/l/cbCaiob5ZIemd21C","pdf",342311,"English","# Syslog-ng Common Variables\n## Common fields (host, IP, priority, facility, tag, program)\n## Received and message timestamps\n# Syslog-ng Configuration (Sources, Filters, Destinations)\n## Remote sources (udp/tcp)\n## Firewall filter by netmask\n## Output file templates and directories\n# Output Routing\n## ruleset and action mapping for different sources\n# Performance Tuning\n## Queues and flush settings\n# Permissions and Security Context\n## POSIX ACLs\n## SELinux context and port allowance","[{\"question\":\"Which syslog fields are covered by the common variables list?\",\"answer\":\"It covers sending host and source IP, priority and facility text, tags, program name, and both received time and message time using variables like $HOST, $SOURCEIP, $PRIORITY, $FACILITY, $TAGS, $PROGRAM, ${R_DATE}, and ${DATE}.\"},{\"question\":\"How does the document demonstrate separating remote syslog streams from firewall logs?\",\"answer\":\"It defines different sources and routes them through dedicated rulesets. A firewall filter example selects messages based on a specified netmask and then writes results to a dedicated firewall log destination.\"},{\"question\":\"What performance and deployment adjustments are included beyond basic routing?\",\"answer\":\"It includes performance tuning such as main_queue sizing and flush/time_reap settings. It also provides operational steps for POSIX ACLs and SELinux context/port permissions to make remote log directories and ports work correctly.\"}]","Syslog Cheat Sheet - v1.2 - quick reference | PDF",1791945948]