Syslog from Network Devices

Plugin: otel.plugin Module: otel

Overview

Ingest syslog from routers, switches, and firewalls into Netdata. An OpenTelemetry Collector with a syslog receiver parses the device syslog stream and forwards it over OTLP/gRPC to the Netdata Agent, which stores it in Netdata's indexed log store you explore and query in the Logs tab.

Netdata does not listen for syslog directly. You run an OpenTelemetry Collector configured with a syslog receiver pointed at the Agent's OTLP/gRPC endpoint (default 127.0.0.1:4317); the Agent's otel plugin writes the records to Netdata's indexed log store.

This integration is only supported on the following platforms:

• Linux
• macOS

This integration runs as a single instance per Netdata Agent.

Default Behavior

Auto-Detection

Not auto-detected. Configure an OpenTelemetry Collector syslog receiver to forward to the Agent's OTLP endpoint.

Limits

The default configuration for this integration does not impose any limits.

Performance Impact

The default configuration for this integration is not expected to impose a significant performance impact on the system.

Setup

Prerequisites

The OpenTelemetry plugin

The Netdata Agent must include the otel plugin, which is available on Linux and macOS. See the OpenTelemetry collector documentation for how it is enabled in each installation method.

An OpenTelemetry Collector

An OpenTelemetry Collector with a syslog receiver, reachable by your network devices, exporting over OTLP to the Agent's endpoint (127.0.0.1:4317 by default).

Devices pointed at it

The routers, switches, and firewalls must be configured to send syslog to the collector's listener.

Configuration

Options

The syslog receiver itself is configured on the OpenTelemetry Collector, not in the Agent. Use otel.yaml only to change the Agent's OTLP endpoint or retention. A ready-to-use syslog pipeline is in Syslog via the OpenTelemetry Collector. The endpoint listens on loopback by default, which accepts only local senders. Running the Collector on another host means binding a non-loopback address, and an OTLP endpoint reachable off-host must be protected with TLS or mutual TLS (endpoint.tls_cert_path, endpoint.tls_key_path, and endpoint.tls_ca_cert_path for mTLS) plus network access controls — otherwise anyone who can reach it can inject telemetry. Prefer keeping the Collector on the same host as the Agent.

Config options

Option	Description	Default	Required
endpoint.path	OTLP/gRPC endpoint the Agent listens on. The default accepts only local senders; bind a non-loopback address to accept a Collector on another host, and protect it when you do.	127.0.0.1:4317	no
endpoint.tls_cert_path	Server TLS certificate. Set together with endpoint.tls_key_path.		no
endpoint.tls_key_path	Server TLS private key.		no
endpoint.tls_ca_cert_path	CA certificate used to verify client certificates. Setting it enables mutual TLS and therefore also requires the server certificate and key.		no

via File

The configuration file name for this integration is otel.yaml.

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config otel.yaml

Examples

Accepting a Collector on another host

Binds a routable address and requires client certificates, so only Collectors holding a certificate signed by your CA can send. Without the TLS keys this endpoint would accept telemetry from anyone who can reach it.

endpoint:
  path: 0.0.0.0:4317
  tls_cert_path: /etc/netdata/ssl/otel.crt
  tls_key_path: /etc/netdata/ssl/otel.key
  tls_ca_cert_path: /etc/netdata/ssl/ca.crt

Alerts

There are no alerts configured by default for this integration.

Metrics