Destination drivers output log messages to somewhere outside syslog-ng: a file or a network socket.
The file driver is one of the most important destination drivers in syslog-ng. It allows you to output logmessages to the named file, or as you'll see to a set of files.
The destination filename may include macros which gets expanded when the message is written, thus a simple file() driver may result in several files to be created. Macros can be included by prefixing the macro name with a '$' sign (without the quotes), just like in Perl/PHP.
If the expanded filename refers to a directory which doesn't exist, it'll be created depending on the create_dirs() setting (both global and a per destination option)
Warning: since the state of each created file must be tracked by syslog-ng, it consumes some memory for each file. If no new messages are written to a file within 60 seconds (controlled by the time_reap global option), it's closed, and its state is freed.
Exploiting this a DoS attack can be mounted against your system. If the number of possible destination files and its needed memory is more than the amount your logserver has.
The most suspicious macro is $PROGRAM, where the possible variations is quite high, so in untrusted environments $PROGRAM usage should be avoided.
Table 3-3. Available macros in filename expansion
Name | Description |
---|---|
HOST | The name of the source host where the message is originated from. If the message traverses several hosts, and chain_hostnames() is on, the first one is used. |
FACILITY | The name of the facility, the message is tagged as coming from. |
PRIORITY or LEVEL | The priority of the message. |
PROGRAM | The name of the program the message was sent by. |
YEAR | The year the message was sent. Time expansion macros can either use the time specified in the log message, e.g. the time the log message is sent, or the time the message was received by the log server. This is controlled by the use_time_recvd() option. |
MONTH | The month the message was sent. |
DAY | The day of month the message was sent. |
HOUR | The hour of day the message was sent. |
MIN | The minute the message was sent. |
SEC | The second the message was sent. |
Table 3-4. Available options for file()
Name | Type | Description | Default |
---|---|---|---|
log_fifo_size() | number | The number of entries in the output fifo. | Use global setting. |
sync_freq() | number | The logfile is synced when this number of messages has been written to it. | Use global setting. |
encrypt() | yes or no | Encrypt the resulting file. NOTE: this is not implemented as of 1.3.14. | Use global setting. |
compress() | yes or no | Compress the resulting logfile using zlib. NOTE: this is not implemented as of 1.3.14. | Use global setting. |
owner() | string | Set the owner of the created filename to the one specified. | root |
group() | string | Set the group of the created filename to the one specified. | root |
perm() | number | The permission mask of the file if it is created by syslog-ng. | 0600 |
dir_perm() | number | The permission mask of directories created by syslog-ng. Log directories are only created if a file after macro expansion refers to a non-existing directory, and dir creation is enabled using create_dirs(). | 0600 |
create_dirs() | yes or no | Enable creating non-existing directories. | no |
This driver sends messages to a named pipe like /dev/xconsole
This driver sends messages to a unix socket in either SOCK_STREAM or SOCK_DGRAM mode.
This driver sends messages to another host on the local intranet or internet using either UDP or TCP protocol.
This driver writes messages to the terminal of a logged-in user.
This driver fork()'s executes the given program with the given arguments and sends messages down to the stdin of the child.