The Syslog Destination in Cribl Stream

What it is for

Cribl Stream's Syslog Destination sends data out over syslog via TCP or UDP, and supports both RFC 3164 and RFC 5424. Per the Syslog Destination documentation, it is a streaming destination: TLS is configurable, persistent queue (PQ) support is included, and it forwards data using internal fields including __priority, __facility, __severity, __appname, and __syslogout. Two caveats precede configuration: outbound data is not compressed (PQ compression affects only on-disk storage of queued data), and an extra post-processing step after the pipeline structures data for the syslog transport.

Configuring the destination

From the top bar, select Products > Cribl Stream and a Worker Group, then add the destination (QuickConnect or routes) and Save and Commit & Deploy.

General Settings. Output ID is a unique name; cloning adds -CLONE to the original. Description is optional. Protocol defaults to TCP; UDP is also available. Load balancing displays only when Protocol is TCP. With load balancing off, Address and Port appear. Record size limit displays when Protocol is UDP; defaults to 1500, and must be ≤ 2048.

Optional Settings. Facility (default user), Severity (default notice), and App name (default Cribl) set field defaults; each is overwritten by the corresponding __facility, __severity, or __appname value if set. Message format defaults to RFC3164. Timestamp format: Syslog (default) or ISO8601. Throttling: rate in bytes per second; defaults to 0, meaning no throttling. Backpressure behavior: block, drop, or queue events when all receivers exert backpressure; defaults to Block. When Throttling is used with Connection limit, the throttling rate applies per connection.

Persistent Queue Settings display when Backpressure behavior is set to Persistent Queue, buffering incoming events during downstream outages or backpressure. Mode selects when the queue engages: Error (destination unavailable or in error), Backpressure (until the event resolves), or Always On (all data immediately); a Worker or Edge Node starting with an invalid Mode automatically switches to Error.

• File size limit: maximum volume per queue file; default 10 MB; on save must be at least the Buffer size limit (bytes).
• Queue size limit: disk space per Worker Process; default 5 GB, up to 1 TB unless a different Worker Process PQ size limit is configured; when reached, the destination stops queueing and applies the Queue-full behavior.
• Compression: codec for persisted data; default None; Gzip is available. Queue-full behavior: block or drop events when the queue exerts backpressure (low or full disk).
• Buffer size limit (bytes): default 1MB, range 64KB to 10MB; replaces the deprecated Buffer size limit (events).
• Backpressure duration limit: displays when Mode is Backpressure; default 30 seconds before data is queued.
• Strict ordering: on by default (FIFO forwarding; the queue flushes every 10 seconds); off, it prioritizes new events and displays Drain rate limit (EPS), whose default 0 disables throttling.
• Clear Persistent Queue: Cloud Enterprise only; deletes queued files without delivering them.

TLS Settings (Client Side). Use TLS defaults to off. Validate server certs defaults to on, rejecting certificates not authorized by a CA in the Trusted server CA path or another trusted CA. Server name (SNI) must be a host name, not an IP address. mTLS adds Certificate, Certificate path, Private key path, and Passphrase fields. Minimum and Maximum TLS version set the thresholds; selecting TLSv1 or TLSv1.1 shows a deprecation warning.

Timeout Settings apply only to TCP: Connection timeout defaults to 10000 milliseconds; Write timeout to 60000 milliseconds.

Processing Settings. Pipeline names a pipeline or pack that processes data before this output sends it. System fields lists fields automatically added to events that use this output; it supports wildcards and defaults to including cribl_pipe.

Advanced Settings. Octet count framing, when enabled, prefixes messages with their byte count, whether constructed from message or __syslogout; when disabled, a \n is appended. Enable Source IP spoofing is displayed only when Protocol is UDP and is available only for on-prem or hybrid Worker Groups (not in Cribl.Cloud or on Cribl Edge Nodes); outgoing UDP packets then carry the Source IP and port from the __srcIpPort field. Log failed requests to disk makes the payload of the most recently failed request available for inspection. Environment supports GitOps: a single Git branch, or empty to enable the configuration everywhere. With Load balancing on, three more options appear: DNS resolution period (seconds), default 600 for TCP and 0 for UDP; Load balance stats period (seconds), default 300; and Connection limit for concurrent receiver connections per Worker Process.

IP spoofing setup. IP spoofing requires raw sockets, so the page describes a helper installed on every Worker Node: download the udp-sender binary to /usr/bin/udp-sender, then grant CAP_NET_RAW with this command, copied from the Syslog Destination documentation:

sudo setcap 'cap_net_raw+eip' /usr/bin/udp-sender

The package installation script creates a udp-senders group and applies the capability; ensure the cribl user is in it. If the helper fails to start, the destination errors and Worker Process logs show a raw socket creation failure.

Using it

With RFC 3164-compliant messages, you get priority, timestamp, host, and message, such that message includes appname and procid, and you will not get msgid or STRUCTURED-DATA. With RFC 5424, Cribl Stream sends the contents of event.structuredData, whether or not they are valid according to the RFC. This RFC 3164-compliant example is copied from the Syslog Destination documentation:

<13>Jul 11 10:34:35 testbox testing[42]

And the RFC 5424 example from the Syslog Destination documentation:

<214>1 2022-07-11T18:58:45.000Z testbox testapp 42 - [exampleSDID@32473 iut="3" foo="bar" this="that"] Here is a message

Cribl recommends the message approach: configure message and leave __syslogout unset, particularly where events enter Cribl Stream from the Syslog Source, which supplies all required fields: facility, severity, _time, host, and message. When message is defined, Cribl Stream discards _raw and composes the payload from the other syslog related fields.

Field logic: if __priority is present, Cribl Stream uses it and ignores facility and severity; otherwise it calculates priority as (8 * Facility) + Severity.

Defining __syslogout makes it the entire syslog message: _raw is discarded and all other fields are ignored. Per the page, its most common use is a non-syslog receiver such as a raw TCP listener; Cribl Stream has no native raw TCP destination. With Octet count framing enabled, the field's byte count is prepended to the message. If neither message nor __syslogout is set, the existing _raw is used as message, which the page does not recommend.

The modal's Live Data tab shows real-time events, Logs records delivery details including errors, and Test verifies sample events. With Log failed requests to disk enabled, a connection error entry in Logs containing See payload file for more info carries the payload path in the file field below it. The Monitoring page covers data volume and rate.

What the docs flag

• The destination does not compress outbound data; compression settings affect only how queued data is stored on disk.
• With UDP, a message over the Record size limit is truncated and followed with an ellipsis, so the value should stay at or below the path MTU.
• Mixing double-underscore and no-underscore field names means Cribl Stream ignores one of them.
• RFC 5424 structuredData and __syslogout values are not validated against the RFCs; a downstream syslog server may misinterpret, drop, or repair non-compliant events.
• Buffer size limit (events) is deprecated in favor of the byte-based limit, and selecting TLSv1 or TLSv1.1 as the minimum version shows a deprecation warning.
• Source IP spoofing is UDP-only, limited to on-prem or hybrid Worker Groups, and unavailable in Cribl.Cloud or on Cribl Edge Nodes.

Frequently asked questions

Which protocol does the Syslog Destination in Cribl Stream use?

The Syslog Destination in Cribl Stream sends syslog messages over TCP or UDP, with TCP as the default protocol. The Record size limit field and the Enable Source IP spoofing option appear only when the protocol is UDP.

Which message formats does the Cribl Stream syslog destination support?

The destination supports the RFC 3164 and RFC 5424 formats, and the Message format option defaults to RFC3164. With RFC 3164, a message carries priority, timestamp, host, and message, where message includes appname and procid, and no msgid or STRUCTURED-DATA is sent. With RFC 5424, the content of event.structuredData is sent whether or not it is valid according to the RFC.

Which output structuring approach does the documentation recommend?

The page recommends the message based approach, where you configure the message field and leave __syslogout unset, particularly when events enter Cribl Stream from the Syslog Source. When message is defined, Cribl Stream discards _raw and composes the payload from the other syslog related fields. The required fields are facility, severity, _time, host, and message.

How does the Cribl Stream syslog destination handle backpressure and failed deliveries?

The Backpressure behavior option chooses whether to block, drop, or queue events when all receivers exert backpressure, and it defaults to Block. If Backpressure behavior is set to Persistent Queue, the queue stops queueing and applies the Queue full behavior when it reaches the Queue size limit. With Log failed requests to disk enabled, the payload of the most recently failed request is available for inspection.