Syslog ingestion with ActiveGate

• How-to guide
• 8-min read
• Updated on Nov 11, 2025

ActiveGate version 1.295+ recommended

Syslog, short for System Logging Protocol, is a logging mechanism that allows system administrators to oversee and control log files from various system components, such as network devices, Linux hosts, syslog servers, or other syslog producers.

This guide shows you how to configure your Environment ActiveGate on Linux to collect syslog logs in your network and ingest them to Dynatrace.

Prerequisites

Hardware requirements

Syslog ingestion is performed by an ActiveGate. The syslog ingestion throughput depends on the hardware on which your ActiveGate is deployed.

Target audience

This guide is intended for network and Dynatrace administrators who are tasked to enable the syslog log ingestion into Dynatrace.

Enable syslog ingestion

To enable syslog ingestion

You've arrived! Now, your syslog-ingested events are enriched with the host-specific attributes and are available in Grail. Thanks to that, you can use these syslog entries for Davis AI-powered data analysis, log processing, or querying via DQL.

Mask sensitive data

ActiveGate syslog ingestion supports the OpenTelemetry Transform Processor and OpenTelemetry Transformation Language (OTTL) to process your syslog data at the edge, before sensitive data leaves your network.

This way, you can mask or hash sensitive data in your syslog lines so that no sensitive information is ingested into Dynatrace.

Let's assume a credit card number is visible in a syslog as follows:

<14>2 2024-07-19T14:53:55Z example-host 0OOButHPbR 1234 - - New operation for CreditCard 1234567891011124

To mask a credit card number, add the following configuration under the processors node of the syslog.yaml file. For details, see the Edit the syslog receiver configuration step under Enable syslog ingestion.

processors:
   transform/redact_credict_cart:
       log_statements:
         - context: log
           statements:
             - replace_pattern(body, "\\d{15,16}", "REDACTED")

The replace_pattern function replaces the credit card number with the REDACTED string. The credit card number in the content is matched by the body, "\\d{15,16}" pattern.

Add custom attributes

You can also modify the default syslog receiver configuration if you want to group a set of various devices by configuring them to use a specific port. For example, using very generic log messages, you can enrich your syslog events sent to specific TCP ports with custom attributes using the configuration as in the example below.

receivers:
 syslog/f5:
    tcp:
      listen_address: "0.0.0.0:54526"
    protocol: rfc5424
    operators:
      - type: add
        field: attributes.log.source
        value: syslog
      - type: add
        field: attributes.dt.ip_addresses
        value: "1xx.xx.xx.xx1"
      - type: add
        field: attributes.instance.name
        value: "ip-1xx-xx-x-xx9.ec2.internal"
      - type: add
        field: attributes.device.type
        value: "f5bigip"
 syslog/host:
    tcp:
      listen_address: "0.0.0.0:54527"
    protocol: rfc5424
    operators:
      - type: add
        field: attributes.log.source
        value: syslog
      - type: add
        field: attributes.device.type
        value: "ubuntu-syslog"

You can also use:

For example, if you can read the net.peer.port attribute, its value is used for custom.remote.port. Otherwise, the custom.report.port isn't set.

attributes:
    actions:
      - key: custom.remote.port
        from_attribute: net.peer.port
        action: upsert

For more information on the attribute configuration, see Attributes Processor.

Filter data

You can filter the syslog data to drop irrelevant log lines and reduce your consumption at the edge, before the data leaves your network.

For example, let's ignore log lines categorized with the syslog facility 21. Below is an example of such a syslog message.

<21> 2024-07-19T14:53:55Z example-host 0OOButHPbR 1234 - - Spam mail

Add the following filter to the syslog.yaml file. For details, see the Edit the syslog receiver configuration step under Enable syslog ingestion.

filter/mail:
logs:
  log_record:
    - attributes["syslog.facility"] == 21

As a result, all log lines with the 21 syslog facility are no longer ingested.

Process logs with technology bundle parsers

Through OpenPipeline, you can use and configure technology bundles. A technology bundle is a library of parsers (processing rules) that process logs from various technologies, such as Java, .NET, and Microsoft IIS.

Parsers help you to improve filtering, troubleshooting, metrics, alerts, and dashboards by efficiently extracting log levels and relevant attributes. You can also use technology bundles to structure logs from technologies that are not supported by Dynatrace out of the box.

Process non-standard syslogs

Sometimes, even when the ingested syslogs follow the format defined by the syslog protocols, they might still slightly deviate from the supported standard. For example, they might contain an additional space or miss a timestamp. To fix that, transform such syslog entries using the Dynatrace OpenPipeline processing.

When there are differences from the syslog standard, the OpenTelemetry Collector fails to parse such syslog entries properly at ingest. They're still forwarded to Dynatrace but are not parsed on the syslog endpoint. Because of this, raw syslog messages are visible in Dynatrace, for example, in Logs or Notebooks.

You can expect errors like this:

Failed to process entry {"operator_id": "syslog_input_internal_parser", "operator_type": "syslog_parser", "error": "expecting a Stamp timestamp [col 5]", ...}

To fix this issue, use OpenPipeline to parse non-standard syslogs with the built-in Syslog technology bundle.

For additional instructions and information on analyzing structured logs, see Process logs with technology bundle parsers.

Troubleshooting

Visit Dynatrace Community for troubleshooting guides, as well as see Troubleshoot Log Management and Analytics.