logmngr

section | description | multi | options
globals | Global Syslog subsystem configuration | false |
name | type | required | default | description
enable | boolean | no | 1 | Enables/disables the Syslog subsystem. Maps to Device.Syslog.Enable.
filter | Defines a log filter (facility, severity, pattern match) referenced by the config action section. Maps to Device.Syslog.Filter.{i}. | true |
name | type | required | default | description
name | string | yes |  | Unique name identifying the filter, referenced by the filter option of a config action section.
facility_level | list | no |  | List of syslog facilities matched by this filter. Valid values: Kern, User, Mail, Daemon, Auth, Syslog, LPR, News, UUCP, Cron, AuthPriv, FTP, NTP, Audit, Console, Cron2, Local0-Local7, All. Treated as All if unset.
severity_level | string | no |  | Severity level threshold for the filter. Valid values: Emergency, Alert, Critical, Error, Warning, Notice, Info, Debug, All, None. Treated as All if unset.
severity_compare | string | no |  | Comparison operator applied against severity_level. Valid values: Equal, EqualOrHigher. Treated as EqualOrHigher if unset.
severity_action | string | no |  | Action taken when the severity comparison matches. Valid values: Log, Block, Stop. Treated as Log if unset.
pattern_match | string | no |  | Pattern/regex used to match against log message content.
source | Defines a log source, only functional with the fluent-bit backend (hard-coded to /dev/log under syslog-ng). Referenced by the config action section. Maps to Device.Syslog.Source.{i}. | true |
name | type | required | default | description
name | string | yes |  | Unique name identifying the source, referenced by the source list of a config action section.
system_messages | boolean | no | 1 | Include system log messages from this source.
kernel_messages | boolean | no | 1 | Include kernel log messages from this source.
template | Defines a log line format expression, only functional with the fluent-bit backend. Referenced by the config action section. Maps to Device.Syslog.Template.{i}. | true |
name | type | required | default | description
name | string | yes |  | Unique name identifying the template, referenced by the template option of a config action section.
expression | string | no |  | Format expression used for log lines, e.g. '{time} {hostname} {ident}: {message}'.
action | Named action tying together filter(s), source(s) and a template, referenced by the config log_file and config log_remote sections. Maps to Device.Syslog.Action.{i}. | true |
name | type | required | default | description
name | string | yes |  | Unique name for the action, referenced by the action option of its child config log_file and config log_remote sections.
source | list | no |  | List of config source section names feeding this action. Only used with the fluent-bit backend.
filter | list | no |  | List of config filter section names applied by this action.
template | string | no |  | Name of the config template section used to format output. Only used with the fluent-bit backend.
log_file | Local file output for a config action section. Maps to Device.Syslog.Action.{i}.LogFile. Auto-created as a child of its action; not independently addable/removable in the data model. | true |
name | type | required | default | description
action | string | yes |  | Name of the parent config action section this log_file belongs to.
enable | boolean | no | 1 | Enables writing logs to the local file.
file | string | no |  | Path to the local log file, exposed as a file:// URI in the data model.
log_remote | Remote syslog output for a config action section. Maps to Device.Syslog.Action.{i}.LogRemote. Auto-created as a child of its action; not independently addable/removable in the data model. | true |
name | type | required | default | description
action | string | yes |  | Name of the parent config action section this log_remote belongs to.
enable | boolean | no | 1 | Enables sending logs to a remote syslog collector.
log_ip | host | no |  | Remote syslog server address.
proto | string | no | udp | Transport protocol used to send remote logs. Valid values: tcp, udp, tls.
port | port | no | 514 | Remote syslog server port.
peer_verify | boolean | no | 0 | If set to 1, verifies the peer certificate. Only meaningful when proto is set to tls.
cert | file | no |  | Path to the certificate file used for TLS connections. Reserved: not yet wired to the Certificate data model parameter in the current implementation.
log_rotate | Log rotation policy for a local log file. Maps to Device.DeviceInfo.LogRotate.{i}. (a separate object tree from Device.Syslog.*). | true |
name | type | required | default | description
enable | boolean | no | 0 | Enables rotation for this log file policy.
file_name | string | no |  | Path of the log file to rotate, exposed as a file:// URI in the data model.
file_count | uinteger | no |  | Number of rotated files to keep.
max_file_size | uinteger | no |  | Maximum size the log file can reach before rotation is triggered.
duration | uinteger | no |  | Rollover interval in minutes, e.g. 1440 for daily rotation.
retention | uinteger | no |  | Retention period in minutes, e.g. 10080 for 7 days.
compression | string | no | None | Compression algorithm applied to rotated files. Valid values: None, GZIP, XZ.