Collect Syslog and rsyslog Logs in SigNoz

With the basic action above, rsyslog drops messages while it cannot connect to the Collector, for example during a Collector restart. To keep these messages and send them when the Collector is back, add retries and a queue. Replace the *.* action(...) line above with this action. Do not keep both actions, because rsyslog then sends each message twice.

*.* action(
  type="omfwd" 
  target="127.0.0.1" 
  port="54527" 
  protocol="tcp"
  action.resumeRetryCount="10"
  queue.type="linkedList" 
  queue.size="10000" 
  template="UTCTraditionalForwardFormat"
)

Some network devices send syslog messages in a format that does not follow RFC 3164 or RFC 5424. Cisco ASA firewalls are an example. A Cisco ASA message with an RFC 5424 timestamp looks similar to this:

<166>2026-10-07T10:15:32Z : %ASA-6-302013: Built inbound TCP connection 4521 for outside:203.0.113.10/51544 (203.0.113.10/51544) to inside:192.168.1.10/443 (192.168.1.10/443)

The syslog receiver cannot parse these messages. Use the tcplog receiver instead. It accepts each line as raw text. A regex_parser operator then extracts the fields from the line.

The steps below use a Cisco ASA firewall as the example.

Configure the tcplog Receiver

Add the tcplog receiver to the receivers section of your OpenTelemetry Collector configuration file:

receivers:
  # ... existing receivers
  # On Collector v0.150.0 and newer, use "tcp_log" to avoid a deprecation warning.
  tcplog:
    listen_address: '0.0.0.0:54527'
    operators:
      - type: regex_parser
        regex: '^(?:.*?(?P<asa_time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z))?.*?%ASA-(?P<asa_severity>\d)-(?P<message_id>\d+): (?P<message>.*)$'
        severity:
          parse_from: attributes.asa_severity
          overwrite_text: true
          mapping:
            fatal: ['0', '1', '2']
            error: '3'
            warn: '4'
            info: ['5', '6']
            debug: '7'
      - type: time_parser
        if: 'attributes.asa_time != ""'
        parse_from: attributes.asa_time
        layout_type: gotime
        layout: '2006-01-02T15:04:05Z07:00'
      - type: remove
        field: attributes.asa_time
      - type: move
        from: attributes.message
        to: body

This configuration does these things:

• The regex_parser operator reads the %ASA-<level>-<message ID>: part of each line. It writes the level to the asa_severity attribute, the message ID to message_id, and the remaining text to message. If the line has an RFC 5424 timestamp, it also writes the timestamp to asa_time.
• The severity block maps the ASA levels 0 to 7 to OpenTelemetry log severities. With overwrite_text: true, SigNoz shows a severity name such as INFO, not the ASA level number.
• The time_parser operator sets the log timestamp from asa_time. If the line has no RFC 5424 timestamp, the operator does nothing and SigNoz uses the time that the Collector received the line. The remove operator then deletes asa_time.
• The move operator puts the message text in the log body.

If your device uses a different format, change the regex to match a line from your device. For the operator options, see the regex_parser documentation.

Enable the tcplog Receiver in the Pipeline

Add tcplog to the service.pipelines.logs.receivers list in the same file:

service:
  pipelines:
    logs:
      receivers: [otlp, tcplog] # Add tcplog here
      processors: [batch, resourcedetection]
      exporters: [otlphttp]

If you named the receiver tcp_log, use tcp_log in this list too. The Collector does not start if the pipeline references a receiver name that is not defined.

Two receivers cannot use the same port. If you keep the syslog receiver from Step 2, change the port in the listen_address of one of the receivers.

Restart the OpenTelemetry Collector as shown in Step 4.

Send Syslog from the Cisco ASA

Run these commands in global configuration mode on the ASA:

logging enable
logging timestamp rfc5424
logging trap informational
logging host <interface-name> <collector-ip> tcp/54527
logging permit-hostdown

Verify these values:

• <interface-name>: The name of the ASA interface that connects to the Collector host, for example inside.
• <collector-ip>: The IP address of the host that runs the OpenTelemetry Collector.

The logging timestamp rfc5424 command adds a UTC timestamp in RFC 5424 format to each message. The ASA does not add timestamps by default. The legacy ASA timestamp format, such as Oct 07 2026 10:15:32, has no time zone, so the configuration above does not parse it. The logging trap informational command sends messages of levels 0 to 6. The ASA uses TCP port 1470 by default, so the logging host command sets port 54527.

Validate the Cisco ASA Logs

To send a test message before you configure the ASA, run this command on the Collector host:

printf '<166>%s : %%ASA-6-302013: Built inbound TCP connection 4521 for outside:203.0.113.10/51544 (203.0.113.10/51544) to inside:192.168.1.10/443 (192.168.1.10/443)\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" | nc -w1 127.0.0.1 54527

The command adds the current UTC time as an RFC 5424 timestamp. Open Logs Explorer in SigNoz and search for message_id = '302013'. The log body starts with Built inbound TCP connection, the severity is INFO, and the timestamp matches the time that you ran the command.

Rsyslog fails to restart or status shows errors

Run rsyslogd -N1 to verify the configuration syntax. Often, typos in the format template or action statement can prevent the service from starting.

You can also check the service logs to see the exact reason for the failure or any runtime issues:

journalctl -u rsyslog.service -b

rsyslog logs cannot connect to 127.0.0.1:54527: Connection refused

The rsyslog journal (journalctl -u rsyslog.service) shows this error, followed by action 'action-7-builtin:omfwd' suspended. The action number can differ. rsyslog cannot connect to the Collector, so it stops forwarding and retries about every 30 seconds.

1. Make sure that the Collector is running: sudo systemctl status otelcol-contrib.
2. Make sure that the syslog receiver is in the logs pipeline and that its listen_address port matches the port in the rsyslog action.
3. To keep messages while the Collector is down, use the production settings for rsyslog. With the basic action, rsyslog drops the messages that arrive while the action is suspended.

Collector logs move: field does not exist: attributes.message

The Collector logs a parse error, such as expecting a Stamp timestamp, and then this error:

failed to send entry after error: move: field does not exist: attributes.message

The syslog receiver failed to parse the message as RFC 3164, so it did not create the message attribute. The move operator then fails. The Collector still exports the raw line, but without parsed fields.

To fix this, compare a raw line from your device with the RFC 3164 format, <PRI>Mmm dd hh:mm:ss hostname tag: message. If the format is different, follow Collect syslog from devices that do not follow RFC 3164.

Logs are not appearing in SigNoz

• Verify the OpenTelemetry Collector is running and there are no errors in its logs.
• Make sure that port 54527 is accessible from the rsyslog host to the OpenTelemetry Collector host (check firewall rules or security groups).
• Check your SigNoz ingestion key and endpoint. For SigNoz Cloud, ensure the URL is correct (e.g., https://ingest.<region>.signoz.cloud:443).
• Temporarily enable verbose logging in rsyslog or check cat /var/log/syslog for forwarding issues.