SYSLOG-Tools(at)Work

SYSLOG-Tools(at)WorkTwo tools for testing syslog.

SYSLOG Sender builds syslog messages and sends them over UDP or TLS 1.3. SYSLOG Receiver accepts the messages, parses them and shows them live in the browser. Both run as ordinary processes on Rocky Linux 9, in VMware and in Proxmox (VM and LXC), and are installed from a single package without internet access.

Senderweb01
Receiversyslog01
TimeSeverityHost / applicationMessage
10:33:24INFOweb01 sshd[1402]Accepted publickey for admin from 10.0.0.20
10:33:26WARNINGfw01 firewalldDropped TCP 10.0.0.9:51234 → 10.20.30.5:22
10:33:28CRITcore-sw01 ENVMON 🔒Power supply 2 failed
Three messages as they appear in the receiver: two over UDP and one over TLS 1.3.

SYSLOG Receiver

2.0.0

A syslog receiver with a web GUI. Accepts messages from network equipment, servers and SYSLOG Sender, parses them and shows them live, with filters, per-message details and export. The interface is available in English and Norwegian.

Receives
Syslog over UDP and over TLS 1.3 on TCP (RFC 5425), at the same time. IPv4 and IPv6. Both octet counting and newline-terminated messages.
Parses
RFC 3164 and RFC 5424, with PROCID, MSGID and structured data. Messages without a valid priority are kept and marked NO-PRI.
Shows
A live list with coloured severity badges, search, filters on transport and severity, per-message details, statistics and the program log. Export to CSV and Excel.
Secures
TLS settings in the browser, without a restart. Mutual TLS to accept known senders only. Certificate management with upload, download and self-signed certificates.
UDP 514inbound, configurable
TLS 6514TLS 1.3, RFC 5425
TCP 8080web GUI
Read the technical description
The message list. Click a row to see every field, including structured data and the raw message.

SYSLOG Sender

2.0.0

Builds syslog messages with any facility, severity, host name, application and MAC address, and sends them to any receiver. One at a time or repeated at a fixed rate, from the browser or the command line.

Sends
UDP or TLS 1.3 over TCP, with verification of the receiver's certificate and an optional client certificate (mutual TLS). IPv4 and IPv6, optional source address.
Formats
RFC 3164 (BSD) and RFC 5424 (IETF) with PROCID and MSGID. The MAC address can go in the message text or as structured data.
Repeated
1–1000 messages per minute for up to 24 hours. The job runs in the background with progress, and can be stopped.
Command line
The same options without a browser, with exit codes for scripts and load tests.
1000/minhighest rate
VM or LXCProxmox too
27tests in the self-test
Read the technical description
The Send Message tab: target, transport, message, format and sending mode in one form.

Used together

The sender is built as the counterpart of the receiver. Installed together, everything is ready for encrypted syslog with mutual TLS in four steps.

  1. Install both

    install.sh creates a test PKI with a CA, server certificate and client certificate, and starts the TLS listener on port 6514.

  2. Choose TLS 1.3 in the sender

    The CA is already selected as the trusted certificate. If the receiver is on another server, download ca.crt from the Certificates tab.

  3. Require a client certificate

    Turn on mutual TLS in the Receiver tab. In the sender, select client.crt and client.key.

  4. See the result

    The messages are shown with 🔒 TLSv1.3 and CN=syslog-sender. Senders without a valid certificate are rejected.

The receiver filtered on TLS: every message shows the TLS version and the CN from the sender's client certificate.

Installation

Both tools come in one offline package. The installer checks checksums, installs hardened systemd services, opens the firewall and finally sends a test message through the system.

Rocky Linux 9, VMware or Proxmox VM

$ sha256sum -c SYSLOG-Tools-2.0.0-offline.tar.gz.sha256
$ tar xzf SYSLOG-Tools-2.0.0-offline.tar.gz
$ cd SYSLOG-Tools-2.0.0
$ sudo ./install.sh --lang en
# open http://<server>:8080/ (Receiver) and :8000 (Sender)

Needs only Python 3.7 or newer, OpenSSL and systemd, all included in Rocky Linux 9 Minimal. Opens the ports in firewalld or ufw. Use receiver or sender to install just one of them.

Proxmox LXC container

# pct push <CTID> SYSLOG-Tools-2.0.0-offline.tar.gz /root/SYSLOG-Tools-2.0.0-offline.tar.gz
# pct enter <CTID>
$ tar xzf SYSLOG-Tools-2.0.0-offline.tar.gz && cd SYSLOG-Tools-2.0.0
$ ./install.sh --lang en
# the container is detected and the hardening adjusted

Works in both unprivileged and privileged containers, without nesting. The container is detected automatically, and the systemd hardening is adjusted to what LXC allows. Remember to open the ports in the Proxmox firewall.

The web interfaces use plain HTTP and should only be reachable from a trusted management network. Restrict access with --admin-net 10.10.0.0/24. Syslog over TLS is encrypted regardless.

Screenshots

Both user interfaces are available in English and Norwegian and also work on mobile. The pictures here are from the English version; the Norwegian page shows Norwegian screenshots. Click to see a picture in full size.

Receiver: the message list
Receiver: status, statistics and TLS 1.3
Receiver: certificates
Receiver: the program log
Receiver: the user manual in the GUI
Receiver: licenses
Receiver: on mobile
Sender: send message
Sender: TLS 1.3 and mutual TLS
Sender: result over TLS 1.3
Sender: repeated sending
Sender: certificates
Sender: the program log
Sender: on mobile