• Log inStart now

Set up network syslog monitoring

Set up your network devices so they send syslog data to New Relic.

Add network syslog data

Prerequisites

New Relic prerequisites

Linux host prerequisites

  • SSH access to the host
  • Access to install/remove applications and services
  • Network access as defined in the network prerequisites

callout.Host-based SNMP trap receiver

To receive syslogs, KTranslate must bind to UDP 514. In a host-based install, the following command will be included during the install process. When executed, KTranslate will be run with elevated privileges.

sudo setcap cap_net_bind_service=+ep /usr/bin/ktranslate

If deployed to Docker

  • Docker installed in a Linux host
  • Ability to launch new containers via command line

Network syslog devices prerequisites

Network security prerequisites

Direction

Source

Destination

Ports

Protocol

Outbound

Docker host only

ktranslate image on Docker Hub or Quay.io

443

TCP

Outbound

Linux or Docker host

New Relic Log API endpoint:

  • US Endpoint:
    https://log-api.newrelic.com
  • EU Endpoint:
    https://log-api.eu.newrelic.com
    New Relic FedRAMP API endpoints
  • FedRAMP Endpoint:
    https://gov-log-api.newrelic.com/log/v1

443

TCP

Inbound

Source devices for syslog data

Linux or Docker host

514 (default)

UDP

Outbound

Linux host only

packagecloud.io for downloading rpm or deb packages (not required for Docker-based install)

443 (default)

TCP

Tip

The default listening port for ktranslate is port 5143 (TCP/UDP). To use the more common syslog port of 514, our guided install redirects traffic into the Docker container with the flag-p 514:5143/udp. To bind the listener to a port above 1024, add -syslog.source="0.0.0.0:<port>" to the end of the run command instead.

Set up network syslog monitoring in New Relic

  1. Go to one.newrelic.com > Add more data.
  2. Scroll down until you see Network monitoring and click Syslog.
  3. Follow the steps in New Relic.

Here's a short video (2:56 minutes) showing how to set up network syslog monitoring:

If you prefer to do the setup manually, see the instructions below.

Tip

ktranslate handles syslog in the following formats: RFC3164, RFC5424, and RFC6587.

While you wait for your data to come in...

Did this doc help you install?

Investigate your device syslog messages in the New Relic logs UI, using the following query:

"plugin.type":"ktranslate-syslog"

To get better visibility into your network device performance, set up SNMP data monitoring.

To get better visibility into how your network is being used, set up network flow data monitoring.

Copyright © 2022 New Relic Inc.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.