# syslog() Source/Destination Driver

### Important Information

Please keep in mind, that the syslog() driver using the standard IEFT-syslog protocol for sending and receiving messages. The IEFT protocol uses frames to separate the individual messages instead of a newline character, thus prototyping with tools such as Netcat might result in an invalid header error. 

> NOTE: \
> The syslog() driver can also receive/send the legacy BSD-syslog-formatted messages.\
> \
> The syslog driver also includes TCP messaging on a TLS-encrypted channel, however, this is tested and verified in a separate post dealing with TLS-encryption with syslog-ng [here](https://syslog-macos-testing.gitbook.io/syslog-macos-testing/modules/afsocket/tls-encryption).

### Status

| Protocol | Architecture | Source | Destination |
| :------: | :----------: | :----: | :---------: |
|    UDP   |      x86     |  Works |    Works    |
|    UDP   |      ARM     |  Works |    Works    |
|    TCP   |      x86     |  Works |    Works    |
|    TCP   |      ARM     |  Works |    Works    |

### How to test

#### Configuration Files Used

To test the syslog driver -- both source and destination drivers, we will run two instances of syslog-ng. One where we are transmitting data using the syslog destination driver that needs to be tested. And another that will listen for the data on the network pipeline established using the syslog source driver.

***Destination Configuration File***

```
#Detination 
@version: 3.31
@include "scl.conf"

options {
    stats-freq(10);
    time-reopen(10);
};

source custom
{
    example-msg-generator(
        num(1)
        template("Syslog-ng instance transmitting data is live.")
    );
    example-msg-generator(
        num(20)
        freq(5)
        template("Message to TCP Destination using Syslog Driver")
    );
    example-msg-generator(
        num(20)
        freq(5)
        template("Message to UDP Destination using Syslog Driver")
    );
};

destination d_tcp { 
    syslog( "127.0.0.1" port(1999) transport(tcp) );
};

destination d_udp {
    syslog( "127.0.0.1" port(5060) transport(udp) );
};

destination console{
    file(/dev/stdout);
};

log {
    source(custom);
    if (message("TCP")) {  
        destination(d_tcp);
    } elif (message("UDP")) {
        destination(d_udp);
    } else {
        destination(console);
    };
};
```

(Note: For more information on how to do conditional destination routing and using template function, click [here](https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/administration-guide/55#TOPIC-1431112).)

***Source Configuration File***

```
@version: 3.31
@include "scl.conf"

options {
    stats-freq(10);
    time-reopen(10);
};

source s_syslog {
    syslog(ip(127.0.0.1) port(1999) transport("tcp"));
    syslog(ip(127.0.0.1) port(5060) transport("udp"));
};

destination console{
    file(/dev/stdout);
};

log {
    source(s_syslog);
    destination(console);
};
```

### **Proof** 

![Syslog driver tested on macOS (x86)](https://3267548193-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MaZdBoDvCx_0JwOUICk%2F-MbkhJr9r6RmZsvecChr%2F-MbknXzUKUXtJnQ5vJtW%2FScreenshot%202021-06-09%20at%203.43.27%20PM.png?alt=media\&token=e85ea807-8651-4abe-be79-1f9dc73f218a)

![Syslog driver tested on macOS (ARM)](https://3267548193-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MaZdBoDvCx_0JwOUICk%2F-Mbknxv6HWR-zzco9L93%2F-MbkooHgm8Ty9G56QX8c%2FScreenshot%202021-06-09%20at%203.49.45%20PM.png?alt=media\&token=19a25d21-55dc-4d95-a242-ca5a629a7751)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://syslog-macos-testing.gitbook.io/syslog-macos-testing/modules/afsocket/syslog-source-destination-driver.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.