Syslog Collector

The collector receives syslog from the network and writes it to storage. Without a running collector, no new messages are accepted.

In Syslog Watcher 7 the collector is a dedicated Windows service, independent of Syslog Watcher Server and of Manager. It can keep collecting while the Server is stopped — for example during an upgrade.

How It Works

Each syslog message passes through the following pipeline before being written to storage:

Syslog Watcher — Syslog Message Collection Pipeline
Figure 1. Syslog message collection pipeline
Stage Description

Network Interfaces

One or more UDP, TCP, or TLS listeners receive raw syslog messages from originators on the network. See Network Interfaces.

Incoming Filter

An optional filter discards unwanted messages early by severity, keywords, or regular expressions (off by default). See Incoming Filter.

Memory Buffer

A configurable memory buffer absorbs bursts of incoming messages when the storage write speed is the bottleneck. See Memory Buffer.

Message Processor

The preprocessor normalizes severity and encoding; originator ID rules associate each message with its sender. See Message Processing.

Syslog Storage

Processed messages are written to the file-based syslog storage database. Features read from this storage later (export, forward, email, HTTP, scripts); they do not sit in the collector pipeline.

In This Section