Syslog destination plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Syslog destination plugin (name: syslog) lets you configure your telemetry pipeline to transmit your data to remote systems or services over the network.

Supported telemetry types

The Syslog destination plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Syslog destination plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

General

Name	Key	Description	Default
Host	`host`	Required. Domain or IP address of the remote Syslog server.	`127.0.0.1`
Port	`port`	Required. TCP or UDP port of the remote Syslog server.	`514`
Mode	`mode`	Required. Selected transport type. Accepted values: `tcp`, `tls`, `udp`.	`udp`
Syslog RFC Format	`syslog_format`	Required. The Syslog protocol format to use. Accepted values: `rfc3164`, `rfc5424`.	`rfc5424`
Syslog Message Key	`syslog_message_key`	Required. This is the key name from the original record that contains the message to deliver. Required, otherwise the message is empty.	none

Advanced

Name	Key	Description	Default
Syslog Severity Key	`syslog_severity_key`	Optional: The key name from the original record that contains the Syslog severity number.	none
Syslog Severity Preset	`syslog_severity_preset`	Optional: The preset severity number. It will be overwritten if `syslog_severity_key` is set and a key of a record is matched.	none
Syslog Facility Key	`syslog_facility_key`	Optional: The key name from the original record that contains the Syslog facility number.	none
Syslog Facility Preset	`syslog_facility_preset`	Optional: The preset facility number. It will be overwritten if `syslog_facility_key` is set and a key of a record is matched.	none
Syslog Hostname Key	`syslog_hostname_key`	Optional: The key name from the original record that contains the hostname that generated the message.	none
Syslog Hostname Preset	`syslog_hostname_preset`	Optional: The preset hostname. It will be overwritten if `syslog_hostname_key` is set and a key of a record is matched.	none
Syslog Appname Key	`syslog_appname_key`	Optional: The key name from the original record that contains the app name that generated the message.	none
Syslog Appname Preset	`syslog_appname_preset`	Optional: The preset app name. It will be overwritten if `syslog_appnam_key` is set and a key of a record is matched.	none
Syslog ProcID Key	`syslog_procid_key`	Optional: The key name from the original record that contains the Process ID that generated the message.	none
Syslog ProcID Preset	`syslog_procid_preset`	Optional: The preset ProcID. It will be overwritten if `syslog_procid_key` is set and a key of a record is matched.	none
Syslog Message ID Key	`syslog_msgid_key`	Optional: The key name from the original record that contains the Message ID associated to the message.	none
Syslog Message ID Preset	`syslog_msgid_preset`	Optional: The preset message ID. It will be overwritten if `syslog_msgid_key` is set and a key of a record is matched.	none
Syslog Structured Data (SD) Key	`syslog_sd_key`	Optional: The key name from the original record that contains the Structured Data (SD) content.	none
Syslog Maxsize	`syslog_maxsize`	The maximum size allowed per message, as an integer in bytes.	Default size based on the `syslog_format` value: `rfc3164` sets this to `1024`, and `rfc5424` sets this to `2048`.

Security and TLS

Name	Key	Description	Default
TLS	`tls`	If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`.	`false`
TLS Certificate Validation	`tls.verify`	If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`.	`on`
TLS Debug Level	`tls.debug`	Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose).	`1`
CA Certificate File Path	`tls.ca_file`	Absolute path to CA certificate file.	none
Certificate File Path	`tls.crt_file`	Absolute path to certificate file.	none
Private Key File Path	`tls.key_file`	Absolute path to private key file.	none
Private Key Path Password	`tls.key_passwd`	Password for private key file.	none
TLS SNI Hostname Extension	`tls.vhost`	Hostname to be used for TLS SNI extension.	none

Advanced Networking

Name	Key	Description	Default
DNS Mode	`net.dns.mode`	Selects the primary DNS connection type, which can be `TCP` or `UDP`.	none
DNS Resolver	`net.dns.resolver`	Selects the primary DNS connection type, which can be `LEGACY` or `ASYNC`.	none
Prefer IPv4	`net.dns.prefer_ipv4`	Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: `true`, `false`.	`false`
Keepalive	`net.keepalive`	Enables or disables Keepalive support. Accepted values: `true`, `false`.	`true`
Keepalive Idle Timeout	`net.keepalive_idle_timeout`	Sets the maximum time allowed for an idle Keepalive connection.	`30s`
Max Connect Timeout	`net.connect_timeout`	Sets the maximum time allowed to establish a connection, which includes the TLS handshake.	`10s`
Max Connect Timeout Log Error	`net.connect_timeout_log_error`	Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: `true`, `false`.	`true`
Source Address	`net.source_address`	Specifies the network address to bind for data traffic.	none
Max Keepalive Recycle	`net.keepalive_max_recycle`	Sets the maximum number of times a keepalive connection can be used before it’s retired.	`2000`