<!--startmeta
custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/go/plugin/go.d/collector/snmp/npm-catalog/integrations/syslog_from_network_devices.md"
meta_yaml: "https://github.com/netdata/netdata/edit/master/src/go/plugin/go.d/collector/snmp/npm-catalog/metadata.yaml"
sidebar_label: "Syslog from Network Devices"
learn_status: "Published"
learn_rel_path: "Network Performance Monitoring/Syslog from Network Devices/Integrations"
keywords: ['syslog', 'opentelemetry', 'otel', 'otlp', 'network devices', 'logs', 'npm']
message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE NPM CATALOG metadata.yaml FILE"
endmeta-->

<!-- markdownlint-disable-file -->

# Syslog from Network Devices


<img src="https://netdata.cloud/img/syslog.png" width="150"/>


Plugin: otel.plugin
Module: otel

<img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" />

## Overview

Ingest syslog from routers, switches, and firewalls into Netdata. An OpenTelemetry Collector with a syslog receiver parses the device syslog stream and forwards it over OTLP/gRPC to the Netdata Agent, which stores it as structured journal logs you explore and query in the Logs tab.

Netdata does not listen for syslog directly. You run an OpenTelemetry Collector configured with a syslog receiver pointed at the Agent's OTLP/gRPC endpoint (default `127.0.0.1:4317`); the Agent's otel plugin writes the records to systemd-compatible journal files.

This integration is only supported on the following platforms:

- Linux
- macOS

This integration runs as a single instance per Netdata Agent.


### Default Behavior

#### Auto-Detection

Not auto-detected. Configure an OpenTelemetry Collector syslog receiver to forward to the Agent's OTLP endpoint.

#### Limits

The default configuration for this integration does not impose any limits.

#### Performance Impact

The default configuration for this integration is not expected to impose a significant performance impact on the system.

## Setup


### Prerequisites

#### The OpenTelemetry plugin

The Netdata Agent must include the `otel` plugin, which is available on Linux and macOS. See the OpenTelemetry collector documentation for how it is enabled in each installation method.

#### An OpenTelemetry Collector

An OpenTelemetry Collector with a `syslog` receiver, reachable by your network devices, exporting over OTLP to the Agent's endpoint (`127.0.0.1:4317` by default).

#### Devices pointed at it

The routers, switches, and firewalls must be configured to send syslog to the collector's listener.


### Configuration

#### Options

The syslog receiver itself is configured on the OpenTelemetry Collector, not in the Agent. Use `otel.yaml` only to change the Agent's OTLP endpoint or retention. A ready-to-use syslog pipeline is in [Syslog via the OpenTelemetry Collector](https://github.com/netdata/netdata/blob/master/docs/npm/syslog/otel-collector.md). The endpoint listens on loopback by default, which accepts only local senders. Running the Collector on another host means binding a non-loopback address, and an OTLP endpoint reachable off-host must be protected with TLS or mutual TLS (`endpoint.tls_cert_path`, `endpoint.tls_key_path`, and `endpoint.tls_ca_cert_path` for mTLS) plus network access controls — otherwise anyone who can reach it can inject telemetry. Note that `auth.enabled` selects the tenant; it does not authenticate the sender. Prefer keeping the Collector on the same host as the Agent.

<details open><summary>Config options</summary>



| Option | Description | Default | Required |
|:-----|:------------|:--------|:---------:|
| endpoint.path | OTLP/gRPC endpoint the Agent listens on. The default accepts only local senders; bind a non-loopback address to accept a Collector on another host, and protect it when you do. | 127.0.0.1:4317 | no |
| endpoint.tls_cert_path | Server TLS certificate. Set together with `endpoint.tls_key_path`. |  | no |
| endpoint.tls_key_path | Server TLS private key. |  | no |
| endpoint.tls_ca_cert_path | CA certificate used to verify client certificates. Setting it enables mutual TLS and therefore also requires the server certificate and key. |  | no |


</details>



#### via File

The configuration file name for this integration is `otel.yaml`.


You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the
Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory).

```bash
cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config otel.yaml
```

##### Examples

###### Accepting a Collector on another host

Binds a routable address and requires client certificates, so only Collectors holding a certificate signed by your CA can send. Without the TLS keys this endpoint would accept telemetry from anyone who can reach it.

```yaml
endpoint:
  path: 0.0.0.0:4317
  tls_cert_path: /etc/netdata/ssl/otel.crt
  tls_key_path: /etc/netdata/ssl/otel.key
  tls_ca_cert_path: /etc/netdata/ssl/ca.crt

```


## Alerts

There are no alerts configured by default for this integration.



## Metrics
