Syslog logging

To enable logging using Syslog, add it to the list of activated log handlers as follows:

To set a different application name, add the --log-syslog-app-name option as follows:

If not set, the application name defaults to keycloak.

To configure the endpoint(host:port) of your centralized logging system, enter the following command and substitute the values with your specific values:

When the Syslog handler is enabled, the host is using localhost as host value. The Default port is 514.

Log level for Syslog log handler can be specified by --log-syslog-level property as follows:

For more information, see [Specify log level for each handler].

Syslog uses TCP as the default protocol for communication. To use UDP instead of TCP, add the --log-syslog-protocol option as follows:

The available protocols are: tpc, udp, and ssl-tcp.

By default, Syslog messages sent over TCP or SSL-TCP are prefixed with the message size, as required by certain Syslog receivers. This behavior is controlled by the --log-syslog-counting-framing option.

To explicitly enable or disable this feature, use the following command:

You can set the value to one of the following:

Note that using protocol-dependent ensures compatibility with most Syslog servers by enabling the prefix only when required by the protocol.

To set the logging format for a logged line, perform these steps:

Note that you need to escape characters when invoking commands containing special shell characters such as ; using the CLI. Therefore, consider setting it in the configuration file instead.

This example abbreviates the category name to three characters by setting [%c{3.}] in the template instead of the default [%c].

Syslog uses different message formats based on particular RFC specifications. To change the Syslog type with a different message format, use the --log-syslog-type option as follows:

Possible values for the --log-syslog-type option are:

The preferred Syslog type is RFC 5424, which obsoletes RFC 3164, known as BSD Syslog protocol.

To set the maximum length of the message allowed to be sent (in bytes), use the --log-syslog-max-length option as follows:

The length can be specified in memory size format with the appropriate suffix, like 1k or 1K. The length includes the header and the message.

If the length is not explicitly set, the default values are set based on the --log-syslog-type option as follows:

By default, the Syslog log handler sends plain unstructured data to the Syslog server. To use structured JSON log output instead, enter the following command:

When using JSON output, colors are disabled and the format settings set by --log-syslog-format does not apply.

To use unstructured logging, enter the following command:

As you can see, the timestamp is present twice, so you can amend it correspondingly by the --log-syslog-format property.