Skip to content
Under attack? Call +1.864.800.0550CareersStoreBlind spot check
Talk to a Principal EngineerTalk to an engineer
Open-source tool · Secure

Azure Syslog Container

A small Docker image that receives syslog from firewalls and network devices over UDP, TCP or TLS and prints each message as one JSON line.

View on GitHubDownload ZIP
  • Early
  • License: None
  • Version: Unversioned
  • Shell
The short version

What problem it solves

Firewalls, switches and appliances usually speak only syslog, while cloud log platforms and SIEMs want structured data. The usual workaround is a dedicated VM running a syslog daemon that someone has to patch and babysit.

This container is a minimal syslog-ng receiver. It accepts plain or TLS-encrypted syslog and writes each message as a JSON line on standard output, where your container platform's log collection can pick it up.

Key features

  • syslog-ng on Ubuntu 22.04
  • Listens on UDP 5515 and TCP 5514
  • Turns on a TLS listener on TCP 10002 automatically when a certificate and key are mounted in /app/certs
  • Each message is written to standard output as JSON (timestamp, host, program, PID, message, facility)
  • A hook to run your own commands at container start
  • A GitHub Actions workflow that builds the image, publishes it to GitHub Container Registry and signs it with cosign

Quick start

The repository has no README yet, so there are no published install steps. The only command in the repository is this TLS test, from a comment in the Dockerfile:

Send a test message over TLS (from the Dockerfile)
(echo -e "<14>1 $(date -Iseconds) test-host test-app 12345 - [example@123 foo=\"bar\"] Test syslog message"; sleep 1) | openssl s_client -verifyCAfile /app/certs/server-cert.pem -chainCAfile /app/certs/server-cert.pem -servername syslog-receiver.local -connect 127.0.0.1:10002 -quiet

Commands are copied from the project's own README or files. For everything else, see the repository (opens in a new tab).

Requirements, license and versions

Requirements

  • Docker, or any platform that runs OCI containers
  • Optional: a PEM certificate and private key (server-cert.pem and server-key.pem) for TLS

License: No license file

The repository has no license file. Without one, nobody else has a clear right to use, copy or modify the code. Add a license before promoting it.

Version and links

No releases or tags.

What's changed

Source: Commit history (the repository has no releases).

  • Image built for linux/amd64 with better image tagging; syslog-ng configuration template added; initial Dockerfile, start script and publish workflow.

Status: Early

Early: 7 commits in a single day, no README, no description, no license and no releases. Clarify the license and add a README before promoting it.

Related offering

Secure

Co-Managed SIEM & Vulnerability Management

“If someone got in tonight, what could they reach, and would we know?”

More open-source tools:

Need help implementing this?

Talk to a Principal Engineer who has used it on real projects. We will tell you how it fits your environment, and when it does not.

REQUEST PRICING