Configuring LogSources for Syslog

LogSources is a LogicModule that provide templates to help you enable LM Logs and configure log data collection and forwarding. LogSources contain details about which logs to get and where to get them, and which fields should be considered for parsing. LogSources is available for common sources of log data. The following describes how to set up LogSources for Syslog.

Requirements

The Syslog logsource type uses the LM Collector. When using the LM Collector with LogSources, the LM Collectors installed in your infrastructure must be version EA 31.200 or later. For information on how to upgrade a collector, see Managing Collectors.

Configuration Options

The following describes configuration options specific to the Syslog type of logsource. For information on how to add a logsource, see Creating LogSources.

Include Filters

You can add filters to include resources of certain types, for example an application. The output matching the filter criteria will be forwarded to the log ingestion process.

Available parameters

Attributes	Comparison operator	Value example	Description
Application	Equal, NotEqual, Contain, NotContain, Exist, NotExist, RegexMatch, RegexNotMatch.		The Value field is disabled if you select “Exist” or “NotExist”.
Facility	Equal, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch, Exist, NotExist, GreaterThan, GreaterEqual, LessThan, LessEqual.	Predefined options like “kernel messages”, “system daemons”, and “log alert”, are available.	The Value field is disabled if you select “Exist” or “NotExist”.
Message	Equal, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch, Exist, NotExist.		The Value field is disabled if you select “Exist” or “NotExist”.
Severity	Equal, MoreUrgentThan.	Emergency, Alert, Critical, Warning, Notice, Informational, Debug.

Log Fields/Tags

You can configure Log Fields/Tags to send additional metadata with the logs.

Available parameters

Method	Key example	Value example	Description
Static	“Customer”	“Customer_XYZ”
Dynamic(REGEX)	“Host”	“host=*”	The query will run on the message field.
LM Property(Token)	“Device”	“##system.deviceId##”	The DeviceID extracted from the existing device property in LogicMonitor.
Syslog Attribute		Application, Facility, Severity.

Resource Mapping

Configure the LM log property to match a monitored resource.

Available parameters

Method	Key example	Value example	Description
Static	“Customer_Id”	For example “1921”.For example “syslog_test_collector”.
IP	“system.ips”		Use the syslog host field information and resolve it to IP, for example “10.20.30.40”. The Value field is disabled if you select this method, you can only enter a Key.
FQDN	“system.hostname”		Fully Qualified Domain Name, from DNS resolution of hostname received from syslog message or socket address. For example “application.service.example.com”.
HOSTNAME	“system.hostname”		For example “host1.example.com”. The Value field is disabled if you select this method, you can only enter a Key.
HOST WITHOUT DNS	“system.hostname”		For example “host1”. The Value field is disabled if you select this method, you can only enter a Key.
Dynamic(REGEX)	“system.ServiceName”	For example “service=*”.	The query will run on the message field.
LM Property(Token)	“token.resourceMap”	For example “syslog_test_collector”.	The DeviceID extracted from the existing device property in LogicMonitor.

Other Options

If you have Syslog events that do not include time information, select Use Received Time instead of Log Timestamp in the Other Options section to use the timestamp for when the log was received by the Collector.

Examples

General Setup Example

General Information

• Name: Syslog
• Description: Data collection template for data from monitored syslogs.
• AppliesTo (custom query): /*isLinux() || isNetwork()*/ 
• Type: LM Logs: Syslog
• Group: Syslog

Resource Mapping

Method	Key	Value
Token	device	##system.hostname##

Resource Mapping Example

The following is an example of a resource mapping using the LM Property (Token) method. Say you provide a property to map to one of the monitored devices in the LM portal. The key for the LM Property is “token.resourceMap” and the value is “syslog_test_collector”.

When a LogSource is applied on the device, the resource mapping is done with LM_property as “token.resourceMap”, source as “LM Property”, parse method as “Token”, and value as anything starting with “##”, like “##token.resourceMap##”.

The collector receives the hostEntry from the feed, and replaces the ##token.resourceMap## with the value received against the LM_property “token.resourceMap” for that particular host, for example “syslog_test_collector”.

If there are multiple resources to which the log source is applied, the value for LM_property should be unique. Otherwise the Ingest API will not map it to the resource as there will be multiple resources having the same mapping.

Example from the Resources information for the example “syslog_test_collector”. 

Example of the resource mapping for the example “syslog_test_collector” in LogSources.

The resource mapping on the collector side for this logsource is as follows:

'{"metadata":{"logSource_id":"2249","logsource_name":"syslog_test_token"},"Severity":"3: Error","Host":"localhost","epochWhenAddedInQueue":1633501246808,"Facility":"1: user-level messages","message":"<11>Just a message with metadata test_md1 !!\u0000","_lm.resourceId":{"token.resourceMap":"syslog_test_collector"},"timestamp":1633501246808,"_lm.collectorId":"48"}', raw:'<11>Example message with metadata test_md1 !!'