SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillssyslog-receiver

syslog-receiver

General & other

View repository

Updated 10-15 17:21

About this skill

Syslog Receiver Skill

Receive and query syslog messages from network devices via UDP.

Skill ID

syslog-receiver

Description

This skill enables NetClaw to receive syslog messages from network devices (routers, switches, firewalls) and query the collected data. It supports both RFC 5424 (modern) and RFC 3164 (BSD/Cisco) syslog formats.

When to Use

  • Monitoring network device events in real-time
  • Investigating incidents by querying historical syslog data
  • Aggregating logs from multiple network devices
  • Filtering messages by severity, facility, hostname, or content
  • Analyzing error patterns across the network

Required MCP Server

syslog-mcp

Available Tools

Tool Purpose
syslog_start_receiver Start listening for syslog messages
syslog_stop_receiver Stop the receiver
syslog_get_status Check receiver status and statistics
syslog_query Search messages with filters
syslog_get_message Get full details of a specific message
syslog_get_severity_counts Get message counts by severity

Example Workflows

Start Monitoring

1. Use syslog_start_receiver with port 10514
2. Configure network devices to send syslog to this port
3. Use syslog_get_status to verify messages are being received

Investigate Errors

1. Use syslog_query with severity_max=3 to find ERROR and above
2. Filter by hostname or source_ip if investigating specific device
3. Use message_contains to search for specific keywords
4. Use syslog_get_message for full details of interesting entries

Daily Summary

1. Use syslog_get_severity_counts to see distribution
2. Focus on CRITICAL, ERROR, WARNING counts
3. Query high-severity messages for details

Sample Prompts

  • "Start the syslog receiver on port 10514"
  • "Show me all error messages from the last hour"
  • "How many critical alerts have we received today?"
  • "Find all syslog messages containing 'interface down'"
  • "What's the syslog receiver status?"
  • "Query syslog for messages from 192.168.1.1"

Configuration

The syslog-mcp server is configured via environment variables:

  • SYSLOG_PORT: UDP listening port (default: 514)
  • SYSLOG_BIND_ADDRESS: Bind address (default: 0.0.0.0)
  • SYSLOG_RETENTION_HOURS: Message retention (default: 24)
  • SYSLOG_RATE_LIMIT: Max messages/second (default: 1000)
  • SYSLOG_DEDUP_WINDOW: Dedup window in seconds (default: 5)

Limitations

  • In-memory storage only (data lost on restart)
  • Single instance per port
  • No persistent storage or export
  • UDP only (no TCP syslog support)

Related Skills

  • snmptrap-receiver - SNMP trap collection
  • ipfix-receiver - Flow data collection
  • gnmi-telemetry - Streaming telemetry

Failure Behavior

  • On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
  • For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.