Nginx log to syslog on TCP port

Question

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do:

error_log syslog:server=192.168.1.1;

However I need to redirect to a specific TCP (not UDP!) port and I tried with:

error_log syslog:server=192.168.1.1:3000;

but it doesn't pass through. How can specify to Nginx that the port should be TCP and not UDP?

Many thanks!

Solution

There is no way to send via TCP in this way, which is quite a common way to send logs on a network, since you want the message delivery to be reliable (look at the RELP module for evidence of that need).

But also, only being able to send logs via UDP is quite common, a number of network devices (switches or routers for example) are only capable of sending by UDP, so sending to a syslog gateway could be a solution, if you're not able to add a listener on the syslog server on the port you want. That would receive your UDP logs, and send them on to your central server via TCP instead.

Myself I would look to collect the logs on the nginx server with rsyslog and forward them on to the central server instead of relying on nginx to do all the work. You can chose the protocol and port to send to.