Syslog Collector

The collector receives syslog messages from the network and writes them to syslog storage. Without a running collector, no new messages are accepted.

The collector runs as a Windows service, independent of Syslog Watcher Server and Manager. It keeps collecting while the Server is stopped — for example during Server updates and security patches.

How It Works

Each message passes through these stages before it is written to syslog storage:

Pipeline: network interfaces, incoming filter, memory buffer, message processor, syslog storage
Syslog message collection pipeline
Network Interfaces

UDP, TCP, and TLS listeners receive messages from originators. The collector reads the severity of each message, or assigns the default severity when the message has none. See Network Interfaces.
Incoming Filter

Optional (off by default). Discards unwanted messages by severity, keywords, or a regular expression, before they take space in the buffer. See Incoming Filter.
Memory Buffer

Holds messages until they are written, so bursts are not lost while storage catches up. See Memory Buffer.
Message Processor

Assigns the originator ID, checks the originator and license limits, and converts the message text to UTF-8. See Message Processing.
Syslog Storage

Processed messages are written to the file-based syslog storage. Features (export, forward, email, HTTP, scripts) read from this storage later; they are not part of the collector.

The Server tab shows how many messages were discarded and why; see Discarded Messages.

Collector Topics