{"id":"486768f4-a2c6-4f23-a099-f1fc85bfb4ac","task":"Ingest syslog (RFC3164 and RFC5424) into the OTel Collector","domain":"github.com/open-telemetry/opentelemetry-collector-contrib","steps":["Add the syslogreceiver to your Collector config under receivers; configure the tcp or udp listener block with listen_address set to the IP and port you want to receive on (e.g., 0.0.0.0:514)","Set protocol to rfc5424 for modern syslog (structured data, MSGID, APP-NAME fields) or rfc3164 for legacy BSD syslog; for syslog that uses valid transport framing but non-standard message format, use protocol: none","For RFC3164 only, set location to an IANA timezone name (e.g., America/New_York) since RFC3164 timestamps do not carry a timezone offset; RFC5424 timestamps are UTC-aware","Enable enable_octet_counting: true on the TCP listener for RFC5424 or none protocols when senders use RFC 6587 octet-counting framing (common for high-reliability syslog forwarding over TCP)","Chain operators in the operators list to further enrich parsed syslog fields: add a resource detection operator to attach host metadata, or a regex_parser to extract fields from the MSG body","Add a pipeline in service.pipelines.logs with the syslog receiver, any processors, and your exporter; verify parsing by setting the log level to debug and checking that syslog fields (severity, facility, hostname, appname) appear as log record attributes"],"gotchas":["RFC3164 does not include a year in the timestamp; the Collector assumes the current year, which can cause January logs received in late December to be assigned the wrong year—this is a known limitation of the RFC","UDP syslog has no delivery guarantee or backpressure mechanism; under high volume, the OS UDP receive buffer fills and datagrams are silently dropped at the kernel level—use TCP with octet-counting framing for reliable delivery","Running the receiver on port 514 requires root or CAP_NET_BIND_SERVICE capability; use a port above 1024 and configure syslog senders to target that port, or use a firewall redirect rule to avoid running the Collector as root"],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:33.723Z"},"url":"https://mcp.waymark.network/r/486768f4-a2c6-4f23-a099-f1fc85bfb4ac"}