The route of a log message in AxoSyslog

Purpose:

The following procedure illustrates the route of a log message from its source on the AxoSyslog client to its final destination on the central AxoSyslog server.

Steps:

1. A device or application sends a log message to a source on the AxoSyslog client. For example, an Apache web server running on Linux enters a message into the /var/log/apache file.

2. The AxoSyslog client running on the web server reads the message from its /var/log/apache source.

3. The AxoSyslog client processes the first log statement that includes the /var/log/apache source.

4. The AxoSyslog client performs optional operations (message filtering, parsing, and rewriting) on the message, for example, it compares the message to the filters of the log statement (if any). If the message complies with all filter rules, AxoSyslog sends the message to the destinations set in the log statement, for example, to the remote AxoSyslog server.

   Warning Message filtering, parsing, and rewriting is performed in the order that the operations appear in the log statement.

5. The AxoSyslog client processes the next log statement that includes the /var/log/apache source, repeating Steps 3-4.

6. The message sent by the AxoSyslog client arrives from a source set in the AxoSyslog server.

7. The AxoSyslog server reads the message from its source and processes the first log statement that includes that source.

8. The AxoSyslog server performs optional operations (message filtering, parsing, and rewriting) on the message, for example, it compares the message to the filters of the log statement (if any). If the message complies with all filter rules, AxoSyslog sends the message to the destinations set in the log statement.

   Warning Message filtering, parsing, and rewriting is performed in the order that the operations appear in the log statement.

9. The AxoSyslog server processes the next log statement, repeating Steps 7-9.

   Note The AxoSyslog application can stop reading messages from its sources if the destinations cannot process the sent messages. This feature is called flow-control and is detailed in Managing incoming and outgoing messages with flow-control.