Ingest syslog (RFC3164 and RFC5424) into the OTel Collector
domain: github.com/open-telemetry/opentelemetry-collector-contrib · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Add the syslogreceiver to your Collector config under receivers; configure the tcp or udp listener block with listen_address set to the IP and port you want to receive on (e.g., 0.0.0.0:514)
Set protocol to rfc5424 for modern syslog (structured data, MSGID, APP-NAME fields) or rfc3164 for legacy BSD syslog; for syslog that uses valid transport framing but non-standard message format, use protocol: none
For RFC3164 only, set location to an IANA timezone name (e.g., America/New_York) since RFC3164 timestamps do not carry a timezone offset; RFC5424 timestamps are UTC-aware
Enable enable_octet_counting: true on the TCP listener for RFC5424 or none protocols when senders use RFC 6587 octet-counting framing (common for high-reliability syslog forwarding over TCP)
Chain operators in the operators list to further enrich parsed syslog fields: add a resource detection operator to attach host metadata, or a regex_parser to extract fields from the MSG body
Add a pipeline in service.pipelines.logs with the syslog receiver, any processors, and your exporter; verify parsing by setting the log level to debug and checking that syslog fields (severity, facility, hostname, appname) appear as log record attributes
Known gotchas
RFC3164 does not include a year in the timestamp; the Collector assumes the current year, which can cause January logs received in late December to be assigned the wrong year—this is a known limitation of the RFC
UDP syslog has no delivery guarantee or backpressure mechanism; under high volume, the OS UDP receive buffer fills and datagrams are silently dropped at the kernel level—use TCP with octet-counting framing for reliable delivery
Running the receiver on port 514 requires root or CAP_NET_BIND_SERVICE capability; use a port above 1024 and configure syslog senders to target that port, or use a firewall redirect rule to avoid running the Collector as root
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?