README.md in remote_syslog-1.2.1 vs README.md in remote_syslog-1.3.0
- old
+ new
@@ -39,18 +39,21 @@
Example: remote_syslog -c configs/logs.yml -p 12345 /var/log/mysqld.log
Options:
-c, --configfile PATH Path to config (/etc/log_files.yml)
-d, --dest-host HOSTNAME Destination syslog hostname or IP (logs.papertrailapp.com)
+ -p, --dest-port PORT Destination syslog port (514)
-D, --no-detach Don't daemonize and detach from the terminal
-f, --facility FACILITY Facility (user)
- -p, --dest-port PORT Destination syslog port (514)
+ --hostname HOST Local hostname to send from
-P, --pid-dir DIRECTORY Directory to write .pid file in (/var/run/)
+ --pid-file FILENAME PID filename (<program name>.pid)
+ --parse-syslog Parse file as syslog-formatted file
-s, --severity SEVERITY Severity (notice)
+ --tls Connect via TCP with TLS
--strip-color Strip color codes
-h, --help Show this message
-
## Example
Daemonize, collecting from files mentioned in `./config/logs.yml` as well as
@@ -66,11 +69,18 @@
remote_syslog will daemonize by default. A sample init file is in the gem as
remote_syslog.init.d. You may be able to:
$ cp examples/remote_syslog.init.d /etc/init.d/remote_syslog
+## Sending messages securely ##
+If the receiving system supports sending syslog over TCP with TLS, you can
+pass the `--tls` option when running `remote_syslog`:
+
+ $ remote_syslog --tls -p 1234 /var/log/mysqld.log
+
+
## Configuration
By default, the gem looks for a configuration in /etc/log_files.yml.
The gem comes with a sample config. Optionally:
@@ -108,9 +118,13 @@
The `syslog` regex is `(\w+ \d+ \S+) (\S+) ([^:]+): (.*)`. It parses this:
Jul 18 08:25:08 hostname programname[1234]: The log message
+Or provide `parse_fields: rfc3339` to parse high-precision RFC 3339
+timestamps like:
+ 2011-07-16T08:25:08.651413-07:00 hostname programname[1234]: The log message
+
Or provide your own regex that includes these 4 backreferences, in order:
timestamp, system name, program name, message. Match and return empty
strings for any empty positions where the log value should be ignored.
For example, in the log: