Skip to content

Integrated Syslog Server

Receive and view syslog messages from your infrastructure

PegaProx includes a built-in syslog server that receives messages via UDP and TCP on port 1514. Messages are parsed (RFC 3164 priority/facility/severity), stored in a local SQLite database, and displayed in a filterable log viewer in the dashboard.

Originally contributed by gyptazy (PR #257), rewritten for gevent compatibility.

UDP + TCP

Listens on port 1514 for both UDP and TCP syslog messages. Uses gevent-compatible sockets for seamless integration with the PegaProx server.

Severity Colors

Log entries are color-coded by severity: red for emergency/alert/critical/error, yellow for warning, blue for notice, gray for info/debug.

Filter & Search

Filter by severity, protocol (UDP/TCP), hostname, source IP, and free-text search. Sortable columns and paginated results (50 per page).

Admin Only

The syslog viewer requires the admin.audit permission. Non-admin users cannot access syslog data.

Tenant scope

A user confined to a tenant or to some clusters sees only lines whose hostname matches a node of a cluster they may use. A node name that two clusters carry is not used as a filter, so one tenant's node name cannot match another tenant's host, and from 1.3 characters such as % and _ in a name are matched literally.

Setup

The syslog server starts automatically with PegaProx. It is unauthenticated, so allow port 1514 only from your senders, or switch the receiver off under Settings → Syslog if you do not use it. To send logs from your devices:

# Linux - rsyslog: forward all logs to PegaProx
echo "*.* @pegaprox-host:1514" >> /etc/rsyslog.conf
systemctl restart rsyslog

# Linux - systemd-journal: forward to syslog
echo "[Journal]
ForwardToSyslog=yes" >> /etc/systemd/journald.conf

# Proxmox VE node - forward to PegaProx
echo "*.* @pegaprox-host:1514" >> /etc/rsyslog.d/pegaprox.conf
systemctl restart rsyslog

# Test with netcat
echo '<14>Apr 06 12:00:00 testhost myapp: Hello PegaProx' | nc -u -w1 pegaprox-host 1514

Viewing Logs

Open the PegaProx dashboard, go to the Datacenter view, and click the "Syslog" tab (next to Snapshot Overview and Topology View). Use the filter bar to narrow down by severity, hostname, protocol, or free-text search.

Storage

Syslog messages are stored in config/syslog.db (SQLite with WAL mode for performance). Syslog rows are pruned automatically by a background retention job that runs roughly hourly. The retention window defaults to 30 days and is configurable via the syslog_retention_days server setting (1–3650 days). No external cron job is required.

API

Method Endpoint Description
GET /api/syslog/events?page=1&per_page=50&severity=3&protocol=UDP&hostname=fw01&search=blocked Paginated, filtered syslog events (admin.audit permission required)

Query parameters: page, per_page (max 200), search, severity (0-7), protocol (UDP/TCP), hostname, source_ip, facility, sort_by, sort_dir (asc/desc).