Get-Syslog Cmdlet
Parameters Output Objects Config Settings
The Get-Syslog component is used to receive network system log packets.
Syntax
Get-Syslog [parameters]
Remarks
The Syslog cmdlet implements a lightweight BSD syslog server as specified in RFC 3164. The cmdlet is used to receive BSD system network logging packets.
To use Syslog cmdlet you must specify a LocalPort value. Optionally, you can also set the Time property for the amount of seconds that the cmdlet should listen for incoming syslog messages. Setting LocalIP will bind to the specified local interface, this comes in handy when more than one network interfaces are available in the local host. For each packet, the cmdlet will parse the headers and message and return a IncomingSyslog event.
The cmdlets support pipeline input for some of their parameters. Prebuilding an object and piping it to the cmdlet is very useful, but should be used with caution to prevent security conflicts. Steps have been taken to decrease the risk of a possibly accidental pipe to the cmdlet, for instance, the Credential parameter cannot be piped to the cmdlet and must be specified manually.
#receive syslog packets for 20 seconds
get-syslog -time 20
Parameter List
The following is the full list of the parameters of the cmdlet with short descriptions. Click on the links for further details.
LogFile | The location of a file to which debug information is written. |
Config | Specifies one or more configuration settings. |
LocalIP | The IP address of the local interface to use. |
LocalPort | The local port that the component should use. |
LogFile | The location of a file to which debug information is written. |
Time | Specifies the time that the Syslog daemon should wait for incoming UDP datagrams. |
Output Objects
The following is the full list of the output objects returned by the cmdlet with short descriptions. Click on the links for further details.
IncomingSyslog | Created whenever a system log packet is received. |
Config Settings
The following is a list of config settings for the cmdlet with short descriptions. Click on the links for further details.
AcceptData | Whether the component can accept/receive data. |
AppName | Sets the App-Name field in RFC 5424. |
DelayHostResolution | Whether the hostname is resolved when RemoteHost is set. |
MsgId | Sets the MsgId field in RFC 5424. |
ProcId | Sets the ProcId field in RFC 5424. |
ReceivedAppName | Returns the value of the App-Name field in RFC 5424. |
ReceivedMsgId | Returns the value of the MsgId field in RFC 5424. |
ReceivedProcId | Returns the value of the ProcId field in RFC 5424. |
ReceivedSDElementCount | Returns the number of Structured-data elements in RFC 5424. |
ReceivedSDElementId | Returns the Sd-Id value of the Sd-element with the specified SDElementIndex in RFC 5424. |
ReceivedSDElementIndex | Returns the index of the Structured-Data element in RFC 5424. |
ReceivedSDParamCount | Returns the number of the Sd-param values for the specified SDElementIndex in RFC 5424. |
ReceivedSDParamName | Returns the name of the SD-Param field in RFC 5424. |
ReceivedSDParamValue | Returns the value of the SD-Param field in RFC 5424. |
SDElementCount | Sets the number of Structured-data elements in RFC 5424. |
SDElementId | Sets the Sd-Id value of the Sd-element with the specified SDElementIndex in RFC 5424. |
SDElementIndex | Sets the index of the Structured-Data element in RFC 5424. |
SDParamCount | Sets the number of the Sd-param values for the specified SDElementIndex in RFC 5424. |
SDParamName | Sets the name of the SD-Param field in RFC 5424. |
SDParamValue | Sets the value of the SD-Param field in RFC 5424. |
TCPMessageDelimiter | The message delimiter to use (if any) when sending and receiving over TCP. |
UseHostname | Determines if the local host name or IP address is used in the Syslog header. |
UseLocalTime | Indicates whether to use local time or GMT time for packet timestamps. |
Version | Determines which Syslog version to use. |
CaptureIPPacketInfo | Used to capture the packet information. |
DelayHostResolution | Whether the hostname is resolved when RemoteHost is set. |
DestinationAddress | Used to get the destination address from the packet information. |
DontFragment | Used to set the Don't Fragment flag of outgoing packets. |
LocalHost | The name of the local host through which connections are initiated or accepted. |
LocalPort | The port in the local host where the component binds. |
MaxPacketSize | The maximum length of the packets that can be received. |
QOSDSCPValue | Used to specify an arbitrary QOS/DSCP setting (optional). |
QOSTrafficType | Used to specify QOS/DSCP settings (optional). |
ShareLocalPort | If set to True, allows more than one instance of the component to be active on the same local port. |
UseConnection | Determines whether to use a connected socket. |
UseIPv6 | Whether or not to use IPv6. |
AbsoluteTimeout | Determines whether timeouts are inactivity timeouts or absolute timeouts. |
FirewallData | Used to send extra data to the firewall. |
InBufferSize | The size in bytes of the incoming queue of the socket. |
OutBufferSize | The size in bytes of the outgoing queue of the socket. |
BuildInfo | Information about the product's build. |
CodePage | The system code page used for Unicode to Multibyte translations. |
LicenseInfo | Information about the current license. |
MaskSensitive | Whether sensitive data is masked in log messages. |
UseInternalSecurityAPI | Tells the component whether or not to use the system security libraries or an internal implementation. |
LogFile Parameter (Get-Syslog Cmdlet)
The location of a file to which debug information is written.
Syntax
Get-Syslog -LogFile string
Remarks
When specified, the cmdlet will log debug information to the file. If the file exists, the information will be appended.Default Value
null
Config Property (Get-Syslog Cmdlet)
Specifies one or more configuration settings.
Syntax
Get-Syslog -Config string[]
Remarks
The Config parameter takes one or more name-value pairs that represent the name of the configuration setting and value, i.e.: -config "Name=Value"
Default Value
null
LocalIP Property (Get-Syslog Cmdlet)
The IP address of the local interface to use.
Syntax
Get-Syslog -LocalIP string
Remarks
This parameter is useful when the cmdlet is running on a machine that has more than one network interface (each with its own IP address and network access privileges).
Default Value
""
Parameter Alias
LocalAddress
LocalPort Property (Get-Syslog Cmdlet)
The local port that the component should use.
Syntax
Get-Syslog -LocalPort int
Remarks
If set to 0, the cmdlet will pick the first available port.
Default Value
514
LogFile Property (Get-Syslog Cmdlet)
The location of a file to which debug information is written.
Syntax
Get-Syslog -LogFile string
Remarks
When specified, the cmdlet will log debug information to the file. If the file exists, the information will be appended.
Default Value
""
Time Property (Get-Syslog Cmdlet)
Specifies the time that the Syslog daemon should wait for incoming UDP datagrams.
Syntax
Get-Syslog -Time int
Remarks
The duration (in seconds) for which you wish the cmdlet to receive Syslog datagrams. If this property is set to 0 (default) the cmdlet will listen indefinitely.
Default Value
0
Parameter Alias
Active
IncomingSyslog Output Object (Get-Syslog Cmdlet)
Created whenever a system log packet is received.
Syntax
Object IncomingSyslog {string Server;
string Facility;
string Severity;
string Message;
int SeverityCode;
string Timestamp;
bool Conforms;
string Packet;
string SourceAddress;
int SourcePort;
}
Remarks
System log packets are composed of three main sections, each of which can be broken down into two smaller pieces.
The first section is the PRI, which contains the originating FacilityCode and SeverityCode of the Message. FacilityCode is a value from 0 to 23, with each value being a different part of the system. Facility is a string representation of FacilityCode based on the following convention:
0 | Kernel messages |
1 | User-level messages |
2 | Mail system |
3 | System daemons |
4 | Security/authorization messages |
5 | Messages generated internally by syslogd |
6 | Line printer subsystem |
7 | Network news subsystem |
8 | UUCP subsystem |
9 | Clock daemon |
10 | Security/authorization messages |
11 | FTP daemon |
12 | NTP subsystem |
13 | Log audit |
14 | Log alert |
15 | Clock daemon |
16 | Local use |
17 | Local use |
18 | Local use |
19 | Local use |
20 | Local use |
21 | Local use |
22 | Local use |
23 | Local use |
0 | Emergency - the system is unusable. |
1 | Alert - action must be taken immediately. |
2 | Critical - critical conditions exist. |
3 | Error - error conditions exist. |
4 | Warning - warning conditions exist. |
5 | Notice - normal but significant condition. |
6 | Informational - informative message. |
7 | Debug - debug-level messages. |
The second section contains the Timestamp and Hostname. Timestamp is a string that should conform to the standard structure "MMM DD, HH:MM:SS". The cmdlet will search for the Timestamp and verify that it conforms. If it conforms, the cmdlet will set Hostname, otherwise, everything after the PRI will be placed in Message.
If Conforms is TRUE, then the original syslog packet conforms to the syslog RFC and Timestamp, Hostname, and Message will all have valid values. Otherwise, you should parse the contents of Packet to verify the fields manually.
SourceAddress and SourcePort are the address and port from which Packet was sent. This can be an intermediate syslog server that is simply forwarding packets from the original host.
Config Settings (Get-Syslog Cmdlet)
The cmdlet accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the cmdlet, access to these internal properties is provided through the Config method.Syslog Config Settings
AcceptData:
Whether the component can accept/receive data.When set to false the cmdlet will no longer be able to accept any data. The PacketIn event will not fire.
The default is true. |
|||||||||||
AppName:
Sets the App-Name field in RFC 5424.This setting specifies the App-Name field of the message as defined in RFC 5424
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
DelayHostResolution:
Whether the hostname is resolved when RemoteHost is set.This setting specifies whether a hostname is resolved immediately when RemoteHost is set. If true the cmdlet will resolve the hostname and the IP address will be present in the RemoteHost property.
If false, the hostname is not resolved until needed by the component when a method to connect or send data is called. If desired, ResolveRemoteHost may called to manually resolve the value in RemoteHost at any time.
The default value is false for the default library and true for the Async library. The default value is false. |
|||||||||||
MsgId:
Sets the MsgId field in RFC 5424.This setting specifies the MsgId field as defined in RFC 5424.
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ProcId:
Sets the ProcId field in RFC 5424.This setting specifies the ProcId field as defined in RFC 5424.
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedAppName:
Returns the value of the App-Name field in RFC 5424.This setting returns the value of the App-Name field in RFC 5424.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedMsgId:
Returns the value of the MsgId field in RFC 5424.This setting returns the value of the MsgId field in RFC 5424.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedProcId:
Returns the value of the ProcId field in RFC 5424.This setting returns the value of the ProcId field in RFC 5424.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedSDElementCount:
Returns the number of Structured-data elements in RFC 5424.This setting returns the number of Structured-data elements in RFC 5424.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedSDElementId:
Returns the Sd-Id value of the Sd-element with the specified SDElementIndex in RFC 5424.This setting returns the Sd-Id value of the SD-element with the specified SDElementIndex.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedSDElementIndex:
Returns the index of the Structured-Data element in RFC 5424.This setting returns the index of the Structured-Data element as defined in RFC 5424.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedSDParamCount:
Returns the number of the Sd-param values for the specified SDElementIndex in RFC 5424.This setting returns the number of the SD-param values for the specified SDElementIndex.
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedSDParamName:
Returns the name of the SD-Param field in RFC 5424.This setting returns the name of the SD-Param field as defined in RFC 5424. Append the index in square brackets to refer to the SD-Param field in the specified index: SDParamName[index]
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
ReceivedSDParamValue:
Returns the value of the SD-Param field in RFC 5424.This setting returns the value of the SD-Param field as defined in RFC 5424. Append the index in square brackets to refer to the SD-Param field in the specified index: SDParamValue[index]
This setting is applicable when receiving messages. Note: This setting is only applicable when Version is set to 1 (RFC 5424) The example below demonstrates how to obtain the structured data information from a received message:
|
|||||||||||
SDElementCount:
Sets the number of Structured-data elements in RFC 5424.This setting specifies the number of Structured-data elements in RFC 5424.
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
SDElementId:
Sets the Sd-Id value of the Sd-element with the specified SDElementIndex in RFC 5424.This setting specifies the Sd-Id value of the SD-element with the specified SDElementIndex.
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
SDElementIndex:
Sets the index of the Structured-Data element in RFC 5424.This setting specifies the index of the Structured-Data element as defined in RFC 5424.
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
SDParamCount:
Sets the number of the Sd-param values for the specified SDElementIndex in RFC 5424.This setting specifies the number of the SD-param values for the specified SDElementIndex.
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
SDParamName:
Sets the name of the SD-Param field in RFC 5424.This setting specifies the name of the SD-Param field as defined in RFC 5424. Append the index in square brackets to refer to the SD-Param field in the specified index: SDParamName[index]
Note: This setting is only applicable when Version is set to 1 (RFC 5424) |
|||||||||||
SDParamValue:
Sets the value of the SD-Param field in RFC 5424.This setting specifies the value of the SD-Param field as defined in RFC 5424. Append the index in square brackets to refer to the SD-Param field in the specified index: SDParamValue[index]
Note: This setting is only applicable when Version is set to 1 (RFC 5424) The example below demonstrates how to set the Struct-Data configs:
|
|||||||||||
TCPMessageDelimiter:
The message delimiter to use (if any) when sending and receiving over TCP.When UseTCP is set to True messages may be sent and received using either Octet Counting or Non-Transparent-Framing schemes to separate mesagges sent over the wire. This setting defines the delimiter to use in the Non-Transparent-Framing scheme when sending messages. Possible values are:
This setting is only applicable when sending a message and UseTCP is set to True. |
|||||||||||
UseHostname: Determines if the local host name or IP address is used in the Syslog header. If set to false the cmdlet will use the IP address of the local host name in the header of the Syslog packet. The default value is true. | |||||||||||
UseLocalTime: Indicates whether to use local time or GMT time for packet timestamps.Setting this to True will generate timestamps based on the time in your locality, taking into account your time zone. When this option is False (default), GMT timestamps are generated. | |||||||||||
Version:
Determines which Syslog version to use.
Note: This setting should be set before setting any of the AppName, MsgId, ProcId |
UDP Config Settings
CaptureIPPacketInfo:
Used to capture the packet information.If this is set to true, the component will capture the IP packet information.
The default value for this setting is False. Note: This setting is only available in Windows. |
|
DelayHostResolution:
Whether the hostname is resolved when RemoteHost is set.This setting specifies whether a hostname is resolved immediately when RemoteHost is set. If true the cmdlet will resolve the hostname and the IP address will be present in the RemoteHost property.
If false, the hostname is not resolved until needed by the component when a method to connect or send data is called. If desired, ResolveRemoteHost may called to manually resolve the value in RemoteHost at any time.
The default value is false for the default library and true for the Async library. The default value is false. |
|
DestinationAddress:
Used to get the destination address from the packet information.If CaptureIPPacketInfo is set to true, then this will be populated with the packet's destination address when a packet is received.
This information will be accessible in the DataIn event.
Note: This setting is only available in Windows. |
|
DontFragment: Used to set the Don't Fragment flag of outgoing packets.When set to True, packets sent by the cmdlet will have the Don't Fragment flag set. The default value is False. | |
LocalHost:
The name of the local host through which connections are initiated or accepted.
The LocalHost setting contains the name of the local host
as obtained by the gethostname() system call, or if the
user has assigned an IP address, the value of that address.
In multi-homed hosts (machines with more than one IP interface) setting LocalHost to the value of an interface will make the cmdlet initiate connections (or accept in the case of server cmdlets) only through that interface. If the cmdlet is connected, the LocalHost setting shows the IP address of the interface through which the connection is made in internet dotted format (aaa.bbb.ccc.ddd). In most cases, this is the address of the local host, except for multi-homed hosts (machines with more than one IP interface). |
|
LocalPort:
The port in the local host where the cmdlet binds.
This must be set before a connection is
attempted. It instructs the cmdlet to bind to a specific
port (or communication endpoint) in the local machine.
Setting this to 0 (default) enables the system to choose a port at random. The chosen port will be shown by LocalPort after the connection is established. LocalPort cannot be changed once a connection is made. Any attempt to set this when a connection is active will generate an error. This; setting is useful when trying to connect to services that require a trusted port in the client side. An example is the remote shell (rsh) service in UNIX systems. |
|
MaxPacketSize: The maximum length of the packets that can be received.This setting specifies the maximum size of the datagrams that the cmdlet will accept without truncation. | |
QOSDSCPValue:
Used to specify an arbitrary QOS/DSCP setting (optional).UseConnection must be True to use this setting. This option allows you to specify an arbitrary DSCP value
between 0 and 63. The default is 0. When set to the default value the component will not set a DSCP value.
Note: This setting uses the qWAVE API is only available on Windows 7, Windows Server 2008 R2, and later. |
|
QOSTrafficType:
Used to specify QOS/DSCP settings (optional).UseConnection must be True to use this setting.
You may specify either the text or integer values: BestEffort (0), Background (1), ExcellentEffort (2), AudioVideo (3), Voice (4), and Control (5).
Note: This setting uses the qWAVE API which is only available on Windows Vista and Windows Server 2008 or above. Note: QOSTrafficType must be set before setting Active to true. |
|
ShareLocalPort:
If set to True, allows more than one instance of the cmdlet to be active on the same local port.This option must be set before the cmdlet is activated through
the Active property or it will have no effect.
The default value for this setting is False. |
|
UseConnection:
Determines whether to use a connected socket.UseConnection specifies whether the cmdlet
should use a connected socket or not. The connection is
defined as an association in between the local address/port
and the remote address/port. As such, this
is not a connection in the traditional TCP sense. What it
means is only that the cmdlet will send and receive data
only to and from the specified destination.
The default value for this setting is False. |
|
UseIPv6: Whether or not to use IPv6.By default, the component expects an IPv4 address for local and remote host properties, and will create an IPv4 socket. To use IPv6 instead, set this to True. |
Socket Config Settings
AbsoluteTimeout:
Determines whether timeouts are inactivity timeouts or absolute timeouts.If AbsoluteTimeout is set to True, any method which does not complete within Timeout seconds
will be aborted. By default, AbsoluteTimeout is False, and the timeout is an inactivity timeout.
Note: This option is not valid for UDP ports. |
|
FirewallData: Used to send extra data to the firewall.When the firewall is a tunneling proxy, use this property to send custom (additional) headers to the firewall (e.g. headers for custom authentication schemes). | |
InBufferSize:
The size in bytes of the incoming queue of the socket.
This is the size of an internal queue in the TCP/IP stack.
You can increase or decrease its size depending on the amount
of data that you will be receiving. Increasing the value of the
InBufferSize setting can provide significant improvements in
performance in some cases.
Some TCP/IP implementations do not support variable buffer sizes. If that is the case, when the cmdlet is activated the InBufferSize reverts to its defined size. The same happens if you attempt to make it too large or too small. |
|
OutBufferSize:
The size in bytes of the outgoing queue of the socket.This is the size of an internal queue in the TCP/IP stack.
You can increase or decrease its size depending on the amount
of data that you will be sending. Increasing the value of the
OutBufferSize setting can provide significant improvements in
performance in some cases.
Some TCP/IP implementations do not support variable buffer sizes. If that is the case, when the cmdlet is activated the OutBufferSize reverts to its defined size. The same happens if you attempt to make it too large or too small. |
Base Config Settings
BuildInfo: Information about the product's build.When queried, this setting will return a string containing information about the product's build. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CodePage:
The system code page used for Unicode to Multibyte translations.The default code page is Unicode UTF-8 (65001).
The following is a list of valid code page identifiers:
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
LicenseInfo:
Information about the current license.When queried, this setting will return a string containing information about the license this instance of a cmdlet is using. It will return the following information:
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
MaskSensitive:
Whether sensitive data is masked in log messages.In certain circumstances it may be beneficial to mask sensitive data, like passwords, in log messages. Set this to true to mask sensitive data. The default is false.
This setting only works on these cmdlets: AS3Receiver, AS3Sender, Atom, Client(3DS), FTP, FTPServer, IMAP, OFTPClient, SSHClient, SCP, Server(3DS), Sexec, SFTP, SFTPServer, SSHServer, TCPClient, TCPServer. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
UseInternalSecurityAPI:
Tells the cmdlet whether or not to use the system security libraries or an internal implementation.
When set to false, the cmdlet will use the system security libraries by default to perform cryptographic functions where applicable.
In this case, calls to unmanaged code will be made. In certain environments this is not desirable.
To use a completely managed security implementation set this setting to true.
Setting this setting to true tells the cmdlet to use the internal implementation instead of using the system security libraries. On Windows, this setting is set to false by default. On Linux/macOS, this setting is set to true by default. If using the .NET Standard Library, this setting will be true on all platforms. The .NET Standard library does not support using the system security libraries. Note: This setting is static. The value set is applicable to all cmdlets used in the application. When this value is set the product's system DLL is no longer required as a reference, as all unmanaged code is stored in that file. |