# Syslog Support
## Syslog Support
Spring Integration 2.2 introduced the syslog transformer: `SyslogToMapTransformer`.
You need to include this dependency into your project:
Maven
```
org.springframework.integration
spring-integration-syslog
5.5.9
```
Gradle
```
compile "org.springframework.integration:spring-integration-syslog:5.5.9"
```
This transformer, together with a `UDP` or `TCP` inbound adapter, could be used to receive and analyze syslog records from other hosts.
The transformer creates a message payload that contains a map of the elements from the syslog message.
Spring Integration 3.0 introduced convenient namespace support for configuring a syslog inbound adapter in a single element.
Starting with version 4.1.1, the framework now supports the extended syslog format, as specified in [RFC 5424\>](https://tools.ietf.org/html/rfc5424).
In addition, when using TCP and RFC5424, both `octet counting` and `non-transparent framing` described in [RFC 6587](https://tools.ietf.org/html/rfc6587) are supported.
### Syslog Inbound Channel Adapter
This element encompasses a `UDP` or `TCP` inbound channel adapter and a `MessageConverter` to convert the syslog message to a Spring Integration message.
The `DefaultMessageConverter` delegates to the `SyslogToMapTransformer`, creating a message with its payload being the `Map` of syslog fields.
In addition, all fields except the message are also made available as headers in the message and are prefixed with `syslog_`.
In this mode, only [RFC 3164](https://tools.ietf.org/html/rfc3164) (BSD) syslogs are supported.
Since version 4.1, the `DefaultMessageConverter` has a property called `asMap` (the default is `true`).
When it is `false`, the converter leaves the message payload as the original complete syslog message (in a `byte[]`) while still setting the headers.
Since version 4.1.1, RFC 5424 is also supported, by using the `RFC5424MessageConverter`.
In this case, the fields are not copied as headers, unless `asMap` is set to `false`, in which case the original message is the payload and the decoded fields are headers.
| |To use RFC 5424 with a TCP transport, you must provide additional configuration to enable the different framing techniques described in RFC 6587.
The adapter needs a TCP connection factory that is configured with a `RFC6587SyslogDeserializer`.
By default, this deserializer handles `octet counting` and `non-transparent framing` by using a linefeed (LF) to delimit syslog messages.
It uses a `ByteArrayLfSerializer` when `octet counting` is not detected.
To use different `non-transparent` framing, you can provide it with some other deserializer.
While the deserializer can support both `octet counting` and `non-transparent framing`, only one form of the latter is supported.
If `asMap` is `false` on the converter, you must set the `retainOriginal` constructor argument in the `RFC6587SyslogDeserializer`.|
|---|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
#### Example Configuration
The following example defines a `UDP` adapter that sends messages to the `syslogIn` channel (the adapter bean name is `syslogIn.adapter`):
```
```
The adapter listens on port `1514`.
The following example defines a `UDP` adapter that sends messages to the `fromSyslog` channel (the adapter bean name is `syslogIn`):
```
```
The adapter listens on port `1514`.
The following example defines a `TCP` adapter that sends messages to channel `syslogIn` (the adapter bean name is `syslogIn.adapter`):
```
```
The adapter listens on port `1514`.
Note the addition of the `protocol` attribute.
This attribute can contain `udp` or `tcp`.
It defaults to `udp`.
The following example shows a `UDP` adapter that sends messages to channel `fromSyslog`:
```
```
The preceding example also shows two `SmartLifecycle` attributes: `auto-startup` and `phase`.
It has a reference to a custom `org.springframework.integration.syslog.MessageConverter` with an ID of `converter` and an `error-channel`.
Also notice the `udp-attributes` child element.
You can set various UDP attributes here, as defined in [.UDP Inbound Channel Adapter Attributes](./ip.html#ip-udp-ib-atts).
| |When you use the `udp-attributes` element, you must provide the `port` attribute there rather than on the `inbound-channel-adapter` element itself.|
|---|---------------------------------------------------------------------------------------------------------------------------------------------------|
The following example shows a `TCP` adapter that sends messages to channel `fromSyslog`:
```
```
It also shows how to reference an externally defined connection factory, which can be used for advanced configuration (socket keep-alive and other uses).
For more information, see [TCP Connection Factories](./ip.html#tcp-connection-factories).
| |The externally configured `connection-factory` must be of type `server`, and the port is defined there rather than on the `inbound-channel-adapter` element itself.|
|---|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
The following example shows a `TCP` adapter that sends messages to channel `fromSyslog`:
```
```
The preceding example is configured to use the `RFC 5424` converter and is configured with a reference to an externally defined connection factory with the `RFC 6587` deserializer (required for RFC 5424).