Skip to content

feat: add Syslog TCP Provider#6268

Open
alpar wants to merge 1 commit intokeephq:mainfrom
alpar:syslog-tcp-provider
Open

feat: add Syslog TCP Provider#6268
alpar wants to merge 1 commit intokeephq:mainfrom
alpar:syslog-tcp-provider

Conversation

@alpar
Copy link
Copy Markdown
Contributor

@alpar alpar commented Apr 21, 2026

Summary

Adds a new Syslog TCP Provider that listens for syslog messages on a configurable TCP port and processes them as Keep alerts.

Closes #1750

Features

  • Listens on configurable host/port (default: 0.0.0.0:514)
  • Supports RFC 3164 (BSD) and RFC 5424 syslog message formats
  • Parses syslog priority into facility and severity
  • Maps syslog severity to Keep alert severity levels
  • Graceful fallback for malformed/non-standard messages
  • Consumer pattern with start_consume()/stop_consume() (same as Kafka provider)
  • Full test coverage for parsing, severity mapping, and TCP handling

Usage

Configure the provider with host and port:

providers:
  - type: syslog
    authentication:
      host: 0.0.0.0
      port: 514

Then configure your syslog sources (e.g., vCenter, network devices) to forward to Keep on the configured port.

Alert Fields

Each syslog message is pushed as an alert with:

  • name: app-name - message[:50]
  • message: full syslog message
  • severity: mapped from syslog severity
  • syslog_facility, syslog_severity, syslog_hostname, syslog_app_name, syslog_pid, syslog_timestamp

Severity Mapping

Syslog Keep
Emergency/Alert/Critical critical
Error high
Warning warning
Notice/Informational info
Debug low

Add a new Syslog provider that listens for syslog messages on a TCP port
and processes them as Keep alerts.

Features:
- Listens on configurable TCP port (default: 514)
- Supports RFC 3164 (BSD) and RFC 5424 syslog formats
- Parses priority into facility and severity
- Maps syslog severity to Keep alert severity levels
- Graceful fallback for malformed messages
- Consumer pattern with start_consume/stop_consume

Closes keephq#1750
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Apr 21, 2026

CLA assistant check
All committers have signed the CLA.

@dosubot dosubot Bot added size:L This PR changes 100-499 lines, ignoring generated files. Feature A new feature Provider Providers related issues labels Apr 21, 2026
@alpar
Copy link
Copy Markdown
Contributor Author

alpar commented Apr 23, 2026

Hi @shahargl, gentle ping — CI is green and ready for review. Thanks!

@alpar
Copy link
Copy Markdown
Contributor Author

alpar commented Apr 23, 2026

Hi @shahargl @tb0x, second ping — CI green for 7 days. This adds a Syslog TCP provider for receiving syslog messages as alerts. Ready for review. 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature A new feature Provider Providers related issues size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[➕ Feature]: Process Syslog Messages received on TCP port

2 participants