-* `auto`: Available in {{ site.product.short_name }} 4.10 and later versions. In 4.9 and later versions the new `transport(auto)` option of the syslog() source allows you to support all TCP-based variants with a single source driver. In {{ site.product.short_name }} there numerous transport options and protocols. RFC3164 describes the legacy or BSD syslog protocol, while RFC5424 refers to the more recent syslog protocol. RFC5424 formatted messages normally come with framing or octet counting (RFC6587), where messages are prefixed with the length of the message. Furthermore, some software use RFC5424 message formatting, but without octet counting. In versions prior to {{ site.product.short_name }} 4.9, this many variants meant that that if you wanted to receive logs from RFC3164, and RFC5424 with or without octet counting, you had to configure three different ports on syslog-ng to parse them correctly. In {{ site.product.short_name }} 4.9 and later versions, The new `transport(auto)` option of syslog-ng allows you collect all of these variants using a single port, even the RFC3164 formatting variant with octet counting.
0 commit comments