Features

A feature is a background processor that runs inside the Syslog Watcher Server service. It reads syslog messages that are already in syslog storage and sends them somewhere else: files, a database, another syslog server, email, HTTP, or an external program.

Features are not part of the syslog collector. The collector writes messages to storage. Features consume stored messages after that, so collection continues even if a feature is suspended or failing.

Use features when Syslog Watcher must do more than store logs — for example forward a filtered stream to a SIEM, keep a text copy for another product, or raise email alerts for high-severity events.

How a Feature Processes Messages

Each active, non-suspended feature runs as its own worker thread on the server:

  1. It opens syslog storage and reads messages starting at the timestamp of the last successfully handled message.

  2. It applies the feature filter (severity, originators, optional expression).

  3. Matching messages go to the type-specific exporter (file, ODBC, syslog, email, HTTP, or process).

Messages that do not match the filter still advance the handled timestamp. They are not revisited unless the feature is resumed from an earlier date and time.

New features start suspended. Resume a feature so it begins processing.

Feature Types

Type Role

Export to Files

Write messages to text files, with optional per-originator folders and daily file names.

Export to DB (ODBC)

Insert (or otherwise apply) SQL against an ODBC data source.

Forward to Syslog Server

Forward messages to another syslog server over UDP, TCP, or TLS.

Send Emails

Send email notifications when messages match one or more email rules.

Send HTTP Requests

Send an HTTP request (POST or PUT) to a configured endpoint (webhooks, APIs).

Execute Program/Script

Start a program or script per matching message.

Read Next