syslog

Documentation

Overview

Package syslog forwards log lines to a remote syslog server over UDP or TCP. It is a self-contained leaf (stdlib only, no Culvert coupling) extracted from the flat package main per ADR-0002. The structured-entry writers take `any` (the entry is only JSON-marshalled) so the forwarder needn't know the concrete audit/request-log struct types.

Two formats are supported:

RFC 3164 (BSD syslog) — legacy, accepted everywhere.
RFC 5424 (IETF syslog) — modern SIEMs prefer this for structured data,
  microsecond timestamps, and proper UTF-8 BOM handling.

Priority: facility=1 (user-level), severity=6 (informational) → PRI=14. Audit events are sent at severity=5 (notice) → PRI=13.

Index

• type Writer
  • func NewWriter(network, addr, format string) (*Writer, error)
  • func (s *Writer) Close() error
  • func (s *Writer) Drops() uint64
  • func (s *Writer) Format() string
  • func (s *Writer) Write(p []byte) (int, error)
  • func (s *Writer) WriteAudit(e any)
  • func (s *Writer) WriteRequest(e any)

Types

type Writer

type Writer struct {
	// contains filtered or unexported fields
}

Writer forwards log lines to a remote syslog server over UDP or TCP.

func NewWriter

func NewWriter(network, addr, format string) (*Writer, error)

NewWriter dials the syslog server and returns a ready Writer. format selects the wire format: "rfc3164" (default) or "rfc5424".

func (*Writer) Close

func (s *Writer) Close() error

Close closes the underlying connection.

func (*Writer) Drops

func (s *Writer) Drops() uint64

Drops reports the number of messages dropped because the collector was unreachable or not draining. Monotonic per Writer; delivery is otherwise silent-best-effort, so this is the only loss signal.

func (*Writer) Format

func (s *Writer) Format() string

Format returns the syslog message format ("rfc3164" or "rfc5424").

func (*Writer) Write

func (s *Writer) Write(p []byte) (int, error)

Write implements io.Writer. Each call is a single syslog message at PRI=14.

func (*Writer) WriteAudit

func (s *Writer) WriteAudit(e any)

WriteAudit sends a structured audit entry as a JSON syslog message at severity=5 (notice), which most SIEMs map to a security-relevant priority. The entry is only JSON-marshalled, so any serializable value is accepted.

func (*Writer) WriteRequest

func (s *Writer) WriteRequest(e any)

WriteRequest sends a structured request-log entry as a JSON syslog message at PRI=14 (facility=1 user-level, severity=6 informational).