# Syslog

### Supported Platforms

| Platform           | Metrics | Logs | Traces |
| ------------------ | ------- | ---- | ------ |
| Linux              |         | ✓    |        |
| Windows            |         | ✓    |        |
| macOS              |         | ✓    |        |
| Kubernetes Gateway |         | ✓    |        |
| OpenShift Gateway  |         | ✓    |        |

### Configuration Table

<table><thead><tr><th width="167.1171875">Parameter</th><th width="91.44921875">Type</th><th width="91.16015625">Default</th><th>Description</th></tr></thead><tbody><tr><td>protocol*</td><td><code>enum</code></td><td>"rfc3164"</td><td>The RFC protocol to use when parsing incoming syslog. Valid values are <code>rfc3164</code> or <code>rfc5424</code>.</td></tr><tr><td>connection_type</td><td><code>enum</code></td><td>udp</td><td>The transport protocol to use. Valid values are <code>udp</code> or <code>tcp</code>.</td></tr><tr><td>data_flow</td><td><code>enum</code></td><td>high</td><td>Enable high flow or reduced low flow.</td></tr><tr><td>listen_port*</td><td><code>int</code></td><td>5140</td><td>The port to bind to and receive syslog. Collector must be running as root (Linux) or Administrator (windows) when binding to a port below 1024.</td></tr><tr><td>listen_ip*</td><td><code>string</code></td><td>"0.0.0.0"</td><td>The IP address to bind to and receive syslog.</td></tr><tr><td>timezone</td><td><code>enum</code></td><td>UTC</td><td>RFC3164 only. The timezone to use when parsing timestamps.</td></tr><tr><td>enable_octet_counting</td><td><code>bool</code></td><td>false</td><td>Whether or not to parse using a trailer character. This is a special character that will be the termination character for syslog messages. This is only applicable to <code>tcp</code> and <code>rfc5424</code> configurations.</td></tr><tr><td>non_transparent_framing_trailer</td><td><code>enum</code></td><td>LF</td><td>Whether or not to enable octet counting on syslog framing. This framing allows for the transmission of all characters inside a syslog message. This is only applicable to <code>tcp</code> and <code>rfc5424</code> configurations.</td></tr><tr><td>enable_mutual_tls</td><td><code>bool</code></td><td>false</td><td>Whether or not to use mutual TLS.</td></tr><tr><td>cert_file</td><td><code>string</code></td><td></td><td>Path to the TLS cert to use for TLS-required connections.</td></tr><tr><td>key_file</td><td><code>string</code></td><td></td><td>Path to the TLS key to use for TLS-required connections.</td></tr><tr><td>ca_file</td><td><code>string</code></td><td></td><td>When set, enforces mutual TLS authentication and verifies client certificates.</td></tr><tr><td>tls_min_version</td><td><code>enum</code></td><td>"1.2"</td><td>The minimum TLS version to support. 1.0 and 1.1 should not be considered secure.</td></tr><tr><td>max_log_size</td><td><code>string</code></td><td>"1Mib"</td><td>When using <code>tcp</code>, the maximum size of a log entry to read. A log entry will be truncated if it is larger than max_log_size. Protects against reading large amounts of data into memory.</td></tr><tr><td>async_readers</td><td><code>int</code></td><td>1</td><td>When using <code>udp</code>, determines how many workers read from UDP port and push to buffer. Generally this value should remain at <code>1</code> unless otherwise directed by Bindplane support.</td></tr><tr><td>async_processors</td><td><code>int</code></td><td>3</td><td>When using <code>udp</code>, determines how many workers read from buffer (pushed by readers) and process logs before sending downstream. Increasing this value can be useful when the collector is under significant load.</td></tr><tr><td>max_queue_length</td><td><code>int</code></td><td>100</td><td>When using <code>udp</code>, determines size of buffer being used by async reader workers. When buffer reaches max number, reader workers will block until buffer has room. Increasing this value can be useful if you anticipate short durations of increased log volume. Generally, you should increase <code>async_processors</code> before increasing this value.</td></tr></tbody></table>

<mark style="color:red;">\*</mark>*<mark style="color:red;">required field</mark>*

### Kubernetes

When using this source with Kubernetes or OpenShift, you must create a custom Service resource to\
route traffic to the collector. See the Kubernetes [Service](/deployment/kubernetes/collector/custom-service.md) for more information.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/syslog.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.