Syslog ingestion with ActiveGate

• 8-min read
• Updated on Sep 02, 2025

ActiveGate version 1.295+ recommended

Syslog, short for system logging protocol, is a logging mechanism that enables system administrators to oversee and control log files from various system components, such as network devices, Linux host syslog, syslog servers, or other syslog producers.

This guide shows you how to configure your Environment ActiveGate on Linux to collect syslog logs in your network and ingest them to Dynatrace.

Prerequisites

Hardware requirements

Syslog ingestion is performed by an ActiveGate. The syslog ingestion throughput depends on the hardware your ActiveGate is deployed on.

Who is it for?

This guide is intended for network and Dynatrace admins who are tasked to enable the syslog log ingestion into Dynatrace.

Enable syslog ingestion

Enabling syslog log ingestion requires you to:

receivers:
  syslog/udp:
    udp:
      listen_address: '0.0.0.0:514'
      add_attributes: true
    protocol: rfc5424
    operators:
      - type: syslog_parser
        protocol: rfc5424

  syslog/tcp:
    tcp:
      listen_address: '0.0.0.0:601'
      add_attributes: true
    protocol: rfc5424
    operators:
      - type: syslog_parser
        protocol: rfc5424
#  syslog/tcp_tls:
#    tcp:
#      listen_address: "0.0.0.0:6514"
#      tls:
#        cert_file: "/absolute/path/to/server.crt"
#        key_file: "/absolute/path/to/server.key"
#    protocol: rfc5424
#    operators:
#      - type: syslog_parser
#        protocol: rfc5424

#DO.NOT.MODIFY
exporters:
  otlphttp/syslog: ${file:syslogendpoint.yaml}

processors:
  batch:
    send_batch_size: 512
    send_batch_max_size: 1024
  transform:
    log_statements:
      - context: log
        statements:
          - set(body, attributes["message"])
  attributes:
    actions:
      - key: net.host.name
        action: delete
      - key: net.peer.name
        action: delete
      - key: net.peer.port
        action: delete
      - key: net.transport
        action: delete
      - key: net.host.ip
        action: delete
      - key: dt.ingest.port
        from_attribute: net.host.port
        action: upsert
      - key: dt.ingest.source.ip
        from_attribute: net.peer.ip
        action: upsert
      - key: net.peer.ip
        action: delete
      - key: net.host.port
        action: delete
      - key: syslog.hostname
        from_attribute: hostname
        action: upsert
      - key: hostname
        action: delete
      - key: syslog.facility
        from_attribute: facility
        action: upsert
      - key: facility
        action: delete
      - key: syslog.priority
        from_attribute: priority
        action: upsert
      - key: priority
        action: delete
      - key: syslog.proc_id
        from_attribute: proc_id
        action: upsert
      - key: proc_id
        action: delete
      - key: syslog.version
        from_attribute: version
        action: upsert
      - key: version
        action: delete
      - key: syslog.appname
        from_attribute: appname
        action: upsert
      - key: appname
        action: delete
      - key: message
        action: delete

service:
  telemetry:
    metrics:
      level: none
  pipelines:
    logs/udp:
      receivers: [syslog/udp]
      processors: [transform, attributes, batch]
      exporters: [otlphttp/syslog]
    logs/tcp:
      receivers: [syslog/tcp]
      processors: [transform, attributes, batch]
      exporters: [otlphttp/syslog]
#    logs/tcp_tls:
#      receivers: [syslog/tcp_tls]
#      processors: [transform, attributes, batch]
#      exporters: [otlphttp/syslog]

Note: Do not modify the exporter configuration. It's preconfigured to forward your syslogs to the Dynatrace Environment.

For more information on syslog receiver configuration, see Ingest syslog data using OpenTelemetry Collector.

Mask sensitive data

ActiveGate syslog ingestion supports the OpenTelemetry Transform Processor and OpenTelemetry Transformation Language (OTTL) to process your syslog data at edge, before sensitive data leaves your network.

This way, you can use it to mask or hash sensitive data in your syslog lines, so that no sensitive information is ingested into Dynatrace.

Let's assume your credit card data is visible in syslog as:

<14>2 2024-07-19T14:53:55Z example-host 0OOButHPbR 1234 - - New operation for CreditCard 1234567891011124

To mask a credit card number, add the following configuration under the processors node of the syslog.yaml file:

processors:
   transform/redact_credict_cart:
       log_statements:
         - context: log
           statements:
             - replace_pattern(body, "\\d{15,16}", "REDACTED")

The replace_pattern function replaces the credit card number with the REDACTED string. The credit card number in the content is matched by the body, "\\d{15,16}" pattern.

Add custom attributes

You can also modify the default configuration if you want to group a set of various devices by configuring them to use a specific port. For example, using very generic log messages, you can enrich your syslog events cast on specific TCP ports with custom attributes using the configuration as in the example below.

receivers:
 syslog/f5:
    tcp:
      listen_address: "0.0.0.0:54526"
    protocol: rfc5424
    operators:
      - type: add
        field: attributes.log.source
        value: syslog
      - type: add
        field: attributes.dt.ip_addresses
        value: "1xx.xx.xx.xx1"
      - type: add
        field: attributes.instance.name
        value: "ip-1xx-xx-x-xx9.ec2.internal"
      - type: add
        field: attributes.device.type
        value: "f5bigip"
 syslog/host:
    tcp:
      listen_address: "0.0.0.0:54527"
    protocol: rfc5424
    operators:
      - type: add
        field: attributes.log.source
        value: syslog
      - type: add
        field: attributes.device.type
        value: "ubuntu-syslog"

You can also use:

For example, if we can read the net.peer.port attribute, its value is used for custom.remote.port. Otherwise, the custom.report.port isn't set.

attributes:
    actions:
      - key: custom.remote.port
        from_attribute: net.peer.port
        action: upsert

For more information on attributes configuration, see Attributes Processor.

Filter data

You can filter the syslog data to drop irrelevant log lines and reduce your consumption at edge, before the data leaves your network.

For example, assume we want to ignore log lines categorized with syslog facility 21,

<21> 2024-07-19T14:53:55Z example-host 0OOButHPbR 1234 - - Spam mail

Add the following filter to the syslog.yaml file.

filter/mail:
logs:
  log_record:
    - attributes["syslog.facility"] == 21

The log line isn't ingested based on the 21 syslog facility.

Process logs with technology bundle parsers

Through OpenPipeline, you can use and configure technology bundles. A technology bundle is a library of parsers (processing rules), that process logs from various technologies such as Java, .NET, Microsoft IIS, etc.

Parsers help you to improve filtering, troubleshooting, metrics, alerts, and dashboards by efficiently extracting log levels and relevant attributes. You can also use technology bundles to structure logs from technologies that are not supported by Dynatrace out of the box.