Execute Program/Script

Execute Program/Script starts an executable for matching messages and passes templated command-line arguments. Typical uses: a PowerShell or batch script, a vendor CLI, or an in-house tool that has no syslog, file, or HTTP interface.

The feature reads messages from syslog storage, not from the collector as they arrive. The collector keeps writing to storage even if this feature is slow, suspended, or failing — storage acts as a large buffer so collection is not blocked.
Syslog Watcher — Execute Program/Script feature
Edit Feature: Execute Program/Script

Common Feature, Data Fields, and Filter settings are described in Managing Features. This page covers Program Configuration.

Program Configuration

Setting Description

Executable file

Path of the program to run. Required. Resolved on the server machine, under the account that starts the process (see Username).

Work folder

Working directory for the process. Blank = none passed to CreateProcess (the child inherits the service directory).

Username

Windows account that starts the process: DOMAIN\user, user@domain, or a local name. Blank = run as the Syslog Watcher Server service account (often Local System).

Password

Password for Username (stored via the server secret store). Ignored when Username is blank.

Success exit code

Empty: any exit code is treated as success. A number: only that exit code is success.

The process is created with CREATE_NO_WINDOW (no console window). The feature waits for the process to exit before continuing (there is a timeout). If the program cannot start, times out, or (when Success exit code is set) exits with a different code, the feature is marked Failed and the server retries.

Command Line Parameters

Simple mode uses a single Parameters template, appended after the quoted executable path.

Example:

-File C:\Integrations\SyslogWatcher\scripts\Notify-Ops.ps1 {ORIGINATOR_ID|EscCMD} {MESSAGE|70|EscCMD}

EscCMD escapes the field so it is safer to embed in a Windows command line. Prefer EscCMD for any untrusted syslog text on the command line.

EscCMD adds double quotes only when the value contains whitespace or ". Do not wrap the field in extra quotes in the template — {MESSAGE|EscCMD} is enough.

Click Switch to Advanced Mode / Add Parameters to define several parameter groups. Each group has:

  • a Filter (blank = all messages that already passed the feature filter)

  • a Parameters template

Every matching group’s template is concatenated, in listed order, onto the command line. The program still starts once per syslog message.

If no group matches, the process starts with no extra arguments.

Use several groups when originators need different argument layouts, or when extra arguments should appear only for some messages — for example an extra flag for Error and above.

The command line is assembled from the Parameters template. Without EscCMD (or equivalent), syslog text is inserted as-is. Use EscCMD on syslog fields unless that text is fully controlled.

Notes

  • Scripts (.ps1, .bat, .cmd) usually need the interpreter as Executable file (powershell.exe, cmd.exe) and the script path in the parameters.

  • Local System cannot see mapped drive letters from an interactive Windows session; use UNC paths or a dedicated service account.

  • High-rate filters can spawn many processes; keep the feature filter tight.

Related Topics