Using Syslog as source in Flume

I wanted to figure out how to use Flume for receiving Syslog message. So i tried 2 different configurations one is using Syslog server on TCP port and other on UDP port. This is the flume configuration for listening on UDP port

	# Name the components on this agent
	agent1.sources = syslog1
	agent1.sinks = logger1
	agent1.channels = memory1
	#
	agent1.sources.syslog1.type = syslogudp
	agent1.sources.syslog1.port = 11111
	agent1.sources.syslog1.host = 0.0.0.0
	agent1.sources.syslog1.channels = memory1
	# Describe the sink
	agent1.sinks.logger1.type = logger
	# Use a channel which buffers events in memory
	agent1.channels.memory1.type = memory
	agent1.channels.memory1.capacity = 1000
	agent1.channels.memory1.transactionCapacity = 100
	# Bind the source and sink to the channel
	agent1.sources.syslog1.channels = memory1
	agent1.sinks.logger1.channel = memory1

view raw flumesyslogudp.properties hosted with ❤ by GitHub

Copy the flumesyslogudp.properties file in the conf directory of your flume server and use following command to start flume server

bin/flume-ng agent --conf conf --conf-file conf/flumesyslogudp.properties --name agent1 
-Dflume.root.logger=DEBUG,console

Or you can configure flume to listen on TCP port. Only difference is the source type is syslogtcp instead of syslogudp

	# Name the components on this agent
	agent1.sources = syslog1
	agent1.sinks = logger1
	agent1.channels = memory1
	#
	agent1.sources.syslog1.type = syslogtcp
	agent1.sources.syslog1.port = 11111
	agent1.sources.syslog1.host = 0.0.0.0
	agent1.sources.syslog1.channels = memory1
	# Describe the sink
	agent1.sinks.logger1.type = logger
	# Use a channel which buffers events in memory
	agent1.channels.memory1.type = memory
	agent1.channels.memory1.capacity = 1000
	agent1.channels.memory1.transactionCapacity = 100
	# Bind the source and sink to the channel
	agent1.sources.syslog1.channels = memory1
	agent1.sinks.logger1.channel = memory1

view raw flumesyslogtcp.properties hosted with ❤ by GitHub

bin/flume-ng agent --conf conf --conf-file conf/flumesyslogtcp.properties --name agent1 
-Dflume.root.logger=DEBUG,console