Simple Syslog Server

A simple evented syslog server and parser supporting UDP, TCP & TLS Transports

Install

npm install simple-syslog-server

Usage

Refer to the logger command for testing the examples included in this package.

man logger

Synopsis

const Syslog = require('simple-syslog-server') ;

// Create our syslog server with the given transport
const socktype = 'TCP' ; // or 'TCP' or 'TLS'
const address = '' ; // Any
const port = 20514 ;
var server = Syslog(socktype) ;

// State Information
var listening = false ;
var clients = [] ;
var count = 0 ;

server.on('msg', data => {
	console.log('message received (%i) from %s:%i\n%o\n', ++count, data.address, data.port, data) ;
	/*
	message received (1) from ::ffff:192.168.1.13:59666
	{
	  "facility": "daemon",
	  "facilityCode": 3,
	  "severity": "info",
	  "severityCode": 6,
	  "tag": "systemd[1]",
	  "timestamp": "2018-12-26T17:53:57.000Z",
	  "hostname": "localhost",
	  "address": "::ffff:192.168.1.13",
	  "family": "IPv6",
	  "port": 20514,
	  "size": 80,
	  "msg": "Started Daily apt download activities."
	}	
	*/
})
.on('invalid', err => {
	console.warn('Invalid message format received: %o\n', err) ;
})
.on('error', err => {
	console.warn('Client disconnected abruptly: %o\n', err) ;
})
.on('connection', s => {
	let addr = s.address().address ;
	console.log(`Client connected: ${addr}\n`) ;
	clients.push(s) ;
	s.on('end', () => {
		console.log(`Client disconnected: ${addr}\n`) ;
		let i = clients.indexOf(s) ;
		if(i !== -1)
			clients.splice(i, 1) ;
	}) ;
})
.listen({host: address, port: port})
.then(() => {
	listening = true ;
	console.log(`Now listening on: ${address}:${port}`) ;
})
.catch(err => {
	if ((err.code == 'EACCES') && (port < 1024)) {
		console.error('Cannot listen on ports below 1024 without root permissions. Select a higher port number: %o', err) ;
	}
	else { // Some other error so attempt to close server socket
		console.error(`Error listening to ${address}:${port} - %o`, err) ;
		try {
			if(listening)
				server.close() ;
		}
		catch (err) {
			console.warn(`Error trying to close server socket ${address}:${port} - %o`, err) ;
		}
	}
}) ;

TCP Transport

The above code uses the factory function Syslog to instantiate a server object, based on the transport protocol name given. Alternately, a server instance can be created directly by calling the factory function property of the same name. For example:

const Syslog = require('simple-syslog-server') ;

// Create our syslog server with the given transport
const options = {} ;
const address = '' ; // Any
const port = 20514 ;
const listen = {host: address, port: port} ;
var server = Syslog.TCP(options) ;

server.on('msg', data => {
	console.log('message received from %s:%i\n%o\n', data.address, data.port, data) ;
})
.listen(listen)
.then(() => {
	console.log(`Now listening on: ${address}:${port}`) ;
}) ;

options to the constructor are as per calls to net.createServer().

The listen object passed to the listen method are the same options provided to server.listen().

TLS Transport

const selfsigned = require('selfsigned') ;
const tls = require('tls') ;
const Syslog = require('simple-syslog-server') ;

let attributes = [{ name: 'commonName', value: 'localhost' }] ;
let x509 = selfsigned.generate( attributes, { days: 2 } ) ;

// Create our syslog server with the given transport
const tls_options = {
	key: x509['private'],
	cert: x509['cert'],
	ca: [ x509['cert'] ]
} ;
const address = '' ; // Any
const port = 20514 ;
const listen = {host: address, port: port} ;
var server = Syslog.TLS(options) ;

server.on('msg', data => {
	console.log('message received from %s:%i\n%o\n', data.address, data.port, data) ;
})
.listen(listen)
.then(() => {
	console.log(`Now listening on: ${address}:${port}`) ;
}) ;

Again, options relate to the tls.createServer() call. And listen to the server.listen() call of the TLS.Server object instance.

UDP Transport

const Syslog = require('simple-syslog-server') ;

// Create our syslog server with the given transport
const options = {type: 'udp4'} ;
const address = '' ; // Any
const port = 20514 ;
const listen = {host: address, port: port} ;
var server = Syslog.UDP(options) ;

server.on('msg', data => {
	console.log('message received from %s:%i\n%o\n', data.address, data.port, data) ;
})
.listen(listen)
.then(() => {
	console.log(`Now listening on: ${address}:${port}`) ;
}) ;

Finally, and predictably, options for the UDP transport relate to the dgram.createSocket() call. For UDP sockets, rather than listen, they bind instead. However, the principle is the same as other transport types. Thus, a call to syslog server.listen method is identical to calling bind, and the listen options also relate to socket.bind().

Acknowledgements

Like others who stand on the shoulders of giants, I'd like to acknowledge the contributions of the following people/groups without which, more directly, this modest Node-RED node would not be possible.

• Mark Eschbach and chunpu for their initial work on a node.js implementation of syslog on which I forked to create this module.
• rawpixel for the logo artwork used in this module.

Licence

Portions created by Mark Eschbach and Chunpu are copyrighted and MIT licenced. This module has been relicenced according to Apache 2.0

Copyright (c) 2019 Damien Clark

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.