Back to feature list...

Syslog server

On this page:

Launching syslog server 

Launching a syslog server consists of these steps:

  • Bind the server to an endpoint.
  • Register MessageReceived event to get notified about received messages.
  • Register ErrorOccurred event to get notified about errors.
  • Start the server.
// create a SyslogServer instance
var server = new SyslogServer();

// bind endpoints
server.Bind(SyslogServer.DefaultPort, SyslogTransportProtocol.Udp);
server.Bind(SyslogServer.DefaultPort, SyslogTransportProtocol.Tcp);

// register an event handler for received messages
server.MessageReceived += (s, e) =>
{
    Console.WriteLine("Message from {0}: {1}", e.RemoteEndPoint, e.Message.Text);
};

// register an event handler for errors
server.ErrorOccurred += (s, e) =>
{
    Console.WriteLine("Error occurred ({0}): {1}", e.RemoteEndPoint, e.Error);
};

// start the server
server.Start();

' create a SyslogServer instance
Dim server = New SyslogServer()

' bind endpoints
server.Bind(SyslogServer.DefaultPort, SyslogTransportProtocol.Udp)
server.Bind(SyslogServer.DefaultPort, SyslogTransportProtocol.Tcp)

' register an event handler for received messages
AddHandler server.MessageReceived,
    Sub(s, e) Console.WriteLine("Message from {0}: {1}", e.RemoteEndPoint, e.Message.Text)

' register an event handler for errors
AddHandler server.ErrorOccurred,
    Sub(s, e) Console.WriteLine("Error occurred ({0}): {1}", e.RemoteEndPoint, e.Error)

' start the server
server.Start()

Processing received messages 

The MessageReceived event is not raised asynchronously and blocks the receiver, which means that it must process received messages as fast as possible. Delaying the MessageReceived handler for too long can lead to a loss of messages transmitted over UDP and slow down TCP and TLS connections.

Important: Please be aware that multiple MessageReceived events can occur simultaneously when messages are received from multiple connections.

The following code shows how to use System.Collections.Concurrent.BlockingCollection class to safely offload received messages for further processing: 

// initialize new System.Collections.Concurrent.BlockingCollection
var messageQueue = new BlockingCollection<SyslogMessageReceivedEventArgs>();

// process received messages as fast as possible
server.MessageReceived += (s, e) =>
{
    // put message into queue for further processing
    messageQueue.Add(e);
};

' initialize new System.Collections.Concurrent.BlockingCollection
Dim messageQueue = New BlockingCollection(Of SyslogMessageReceivedEventArgs)()

' process received messages as fast as possible
AddHandler server.MessageReceived,
    Sub(s, e)
        ' put message into queue for further processing
        messageQueue.Add(e)
    End Sub

A corresponding message processing loop might look like this: 

// process received messages
foreach (var args in messageQueue.GetConsumingEnumerable())
{
    Console.WriteLine("Message from {0}: {1}", args.RemoteEndPoint, args.Message.Text);
}

' process received messages
For Each args In messageQueue.GetConsumingEnumerable()
    Console.WriteLine("Message from {0}: {1}", args.RemoteEndPoint, args.Message.Text)
Next

Connection options 

Server bindings offer various options for customization.

For example, the default UDP receive buffer size (1 MB) can be increased: 

// create UDP binding
var binding = new SyslogBinding(SyslogServer.DefaultPort, SyslogTransportProtocol.Udp);

// set UDP buffer size to 10 MB
binding.UdpBufferSize = 10 * 1024 * 1024;

// use the binding
server.Bind(binding);

' create UDP binding
Dim binding = New SyslogBinding(SyslogServer.DefaultPort, SyslogTransportProtocol.Udp)

' set UDP buffer size to 10 MB
binding.UdpBufferSize = 10 * 1024 * 1024

' use the binding
server.Bind(binding)

Setting TLS for syslog server 

Transmitting unecrypted syslog message over the Internet is usually not a good idea. To configure the syslog server to use TLS, use Settings.TlsParameters property. At least the server certificate needs to be specified. 

// create a SyslogServer instance, register events
// ...

// bind endpoint for TLS
server.Bind(SyslogServer.DefaultTlsPort, SyslogTransportProtocol.Tls);

// load a server certificate (must have private key associated)
var certificate = CertificateChain.LoadPfx(serverCertPath, serverCertPassword);

// specify the server certificate
server.Settings.TlsParameters.Certificate = certificate;

// start the server
server.Start();

' create a SyslogServer instance, register events
' ...

' bind endpoint for TLS
server.Bind(SyslogServer.DefaultTlsPort, SyslogTransportProtocol.Tls)

' load a server certificate (must have private key associated)
Dim certificate = CertificateChain.LoadPfx(serverCertPath, serverCertPassword)

' specify the server certificate
server.Settings.TlsParameters.Certificate = certificate

' start the server
server.Start()
Tip: For more information, see TLS/SSL and X.509 certificates.

Back to feature list...