Syslog Messages

This guide shows you how to collect syslog messages and forward them to Sentry using the OpenTelemetry Collector with the Syslog Receiver.

Prerequisites

Before you begin, ensure you have:

• Network access to receive syslog messages (TCP or UDP)
• A Sentry project to send data to

Step 1: Install the OpenTelemetry Collector

The Syslog Receiver is included in the OpenTelemetry Collector Contrib distribution. You'll need to download and install this version, as the standard otelcol binary does not include the Syslog Receiver.

Download the latest otelcol-contrib binary from the OpenTelemetry Collector releases page.

Step 2: Get Your Sentry OTLP Credentials

You'll need your Sentry OTLP endpoint and authentication header. These can be found in your Sentry Project Settings under Client Keys (DSN) > OpenTelemetry (OTLP).

Logs Endpoint

___OTLP_LOGS_URL___

Authentication Header

x-sentry-auth: sentry sentry_key=___PUBLIC_KEY___

Step 3: Configure the Collector

Create a configuration file with the Syslog Receiver and the OTLP HTTP exporter configured to send logs to Sentry.

For additional configuration options like TLS, async processing, or custom attributes, see the Syslog Receiver Documentation.

TCP Configuration (RFC 5424)

This configuration receives syslog messages over TCP using the RFC 5424 format:

receivers:
  syslog:
    tcp:
      listen_address: "0.0.0.0:514"
    protocol: rfc5424

processors:
  batch:
    send_batch_size: 1024
    send_batch_max_size: 2048
    timeout: "1s"

exporters:
  otlphttp/sentry:
    logs_endpoint: ___OTLP_LOGS_URL___
    headers:
      x-sentry-auth: "sentry sentry_key=___PUBLIC_KEY___"
    compression: gzip
    encoding: proto

service:
  pipelines:
    logs:
      receivers:
        - syslog
      processors:
        - batch
      exporters:
        - otlphttp/sentry

UDP Configuration (RFC 3164)

This configuration receives syslog messages over UDP using the older RFC 3164 (BSD syslog) format:

receivers:
  syslog:
    udp:
      listen_address: "0.0.0.0:514"
    protocol: rfc3164
    location: UTC

processors:
  batch:
    send_batch_size: 1024
    send_batch_max_size: 2048
    timeout: "1s"

exporters:
  otlphttp/sentry:
    logs_endpoint: ___OTLP_LOGS_URL___
    headers:
      x-sentry-auth: "sentry sentry_key=___PUBLIC_KEY___"
    compression: gzip
    encoding: proto

service:
  pipelines:
    logs:
      receivers:
        - syslog
      processors:
        - batch
      exporters:
        - otlphttp/sentry

Configuring Syslog Sources

After setting up the collector, configure your systems to send syslog messages to it.

Linux (rsyslog)

Add the following to /etc/rsyslog.conf or create a file in /etc/rsyslog.d/:

# For TCP (RFC 5424)
*.* @@otel-collector-host:514

# For UDP (RFC 3164)
*.* @otel-collector-host:514

Then restart rsyslog:

sudo systemctl restart rsyslog

Linux (syslog-ng)

Add to your syslog-ng configuration:

destination d_otel {
    network("otel-collector-host" port(514) transport("tcp"));
};

log {
    source(s_sys);
    destination(d_otel);
};

Troubleshooting

• Verify the syslog source is sending to the correct host and port
• Ensure firewall rules allow inbound traffic on the configured port
• Confirm the protocol setting matches your syslog source (RFC 3164 vs RFC 5424)

Additional Resources

• Syslog Receiver Documentation
• Sentry OpenTelemetry Collector Configuration
• Sentry Logs