Syslog over TLS

This guide configures logs once syslog over TLS is available. Replace YOUR_INGEST_KEY with your key on your server, never in a public example.

1. Configure rsyslog TLS forwarding

Requires the rsyslog TLS module and a writable workDirectory for the queue. Replace both hostname occurrences and the PEN. The RFC 5424 structured-data element supplies the key, and Site Qwality strips it before storage. Include it on the first record of every new connection. Do not disable certificate verification.

global(workDirectory="/var/spool/rsyslog" DefaultNetstreamDriver="gtls" DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")
module(load="imfile")
template(name="sq5424" type="string" string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% app %PROCID% - [sq@YOUR_ASSIGNED_PEN key=\"YOUR_INGEST_KEY\"] %msg%\n")
input(type="imfile" File="/var/log/my-app/app.log" Tag="app" ruleset="siteqwality")
ruleset(name="siteqwality") {
  action(type="omfwd" target="YOUR_ENABLED_SYSLOG_HOST" port="6514" protocol="tcp"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name"
    StreamDriverPermittedPeers="YOUR_ENABLED_SYSLOG_HOST"
    TCP_Framing="octet-counted" template="sq5424"
    queue.type="LinkedList" queue.filename="siteqwality" queue.saveOnShutdown="on" action.resumeRetryCount="-1")
}

2. Validate the configuration

Restart using your service manager and append a line to the configured file. TLS/TCP syslog has no per-record durable application acknowledgement. Watch your local queue and confirm readable logs.

rsyslogd -N1

See your data

Open Logs, Traces or Metrics. New data usually shows up within a minute, and a page that says it is waiting for data switches to your data on its own. Nothing arriving? See what each status code means in failure handling.

Production checklist

Store the key in your platform secret mechanism, rotate it when exposed and remove test keys. Set a stable service.name and deployment.environment.name; avoid user IDs or unbounded values in metric labels. Prefer a persistent queue, bounded retries and exporter failure monitoring. Review redaction and processors before increasing traffic.