Event logging protocol connector systems and methods
Embodiments provide systems and methods for logging events. A computer-implemented method, for example, includes a syslog connector providing a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion, receiving event records from the cloud source according to the subscription, the received event records formatted according to a first format, transforming the event records received from the cloud source from the first format to syslog messages and storing, by the syslog connector, the syslog messages to a syslog data sink.
1 . A computer-implemented method comprising:
providing, by a syslog connector, a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion;
receiving, by the syslog connector, event records from the cloud source according to the subscription, the received event records formatted according to a first format;
determining to use an output format from a plurality of supported syslog formats for the received event records;
transforming, by the syslog connector, the event records received from the cloud source from the first format to syslog messages according to output format from the plurality of supported syslog formats; and
storing, by the syslog connector, the syslog messages to a syslog data sink.
2 . The computer-implemented method of claim 1 , wherein the syslog connector is an on-premises syslog connector.
3 . The computer-implemented method of claim 1 , wherein the event records are pushed from the cloud source to the syslog connector.
4 . The computer-implemented method of claim 1 , wherein the event records are pulled by the syslog connector from the cloud source.
5 . The computer-implemented method of claim 1 , further comprising:
receiving, by the syslog connector, an event logging configuration, the event logging configuration comprising the event selection criterion and a data sink configuration for the syslog data sink.
6 . The computer-implemented method of claim 5 , wherein the event logging configuration further comprises a polling interval and wherein the syslog connector polls the cloud source for additional event records according to the polling interval.
7 . The computer-implemented method of claim 1 , further comprising:
establishing an event store for the subscription;
evaluating a new event to determine that the new event is subscribed to according to the subscription;
based on the determination that the new event is subscribed to according to the subscription, add an event record for the new event to the event store for the subscription as an unread event record; and
sending the unread event record to the syslog connector and changing the unread event record to a read event record.
8 . The computer-implemented method of claim 7 , wherein the unread event record is pushed to the syslog connector.
9 . The computer-implemented method of claim 7 , wherein the unread event record is sent to the syslog connector responsive to the syslog connector pulling the unread event record.
10 . The computer-implemented method of claim 1 , wherein storing the syslog messages to the syslog data sink comprises sending a syslog file containing the syslog messages to the syslog data sink.
11 . A computer program product comprising a non-transitory, computer-readable medium storing thereon computer-executable instructions, the computer-executable instructions comprising instructions for:
providing a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion;
receiving event records from the cloud source according to the subscription, the received event records formatted according to a first format;
determining to use an output format from a plurality of supported syslog formats for the received event records;
transforming the received event records from the first format to syslog messages according to the output format; and
storing the syslog messages to a syslog data sink.
12 . The computer program product of claim 11 , wherein the event records are received from the cloud source because of being pushed from the cloud source.
13 . The computer program product of claim 11 , further comprising instructions for pulling the event records from the cloud source.
14 . The computer program product of claim 11 , wherein the computer-executable instructions further comprise instructions for receiving an event logging configuration, the event logging configuration comprising the event selection criterion and a data sink configuration for the syslog data sink.
15 . The computer program product of claim 14 , wherein the event logging configuration further comprises a polling interval and wherein the computer-executable instructions further comprise instructions for polling the cloud source for new event records according to the polling interval.
16 . The computer program product of claim 11 , wherein storing the syslog messages to the syslog data sink comprises sending a syslog file containing the syslog messages to the syslog data sink.
17 . An event logging system comprising:
a first processor;
a first non-transitory, computer-readable medium storing thereon first computer-executable instructions that are executable by the first processor, the first computer-executable instructions comprising instructions for:
providing a subscription to a cloud source that collects events from a plurality of data sources, the subscription comprising an event selection criterion;
receiving event records from the cloud source according to the subscription, the received event records formatted according to a first format;
determining to use an output format from a plurality of supported syslog formats for the received event records;
transforming the received event records from the first format to syslog messages according to the output format; and
storing the syslog messages to a syslog data sink;
a second processor; and
a second non-transitory, computer-readable medium storing thereon second computer-executable instructions that are executable by the second processor, the second computer-executable instructions comprising instructions for:
establishing an event store for the subscription;
determining that a new event is subscribed to according to the subscription;
based on the determination that the new event is a subscribed to according to the subscription, adding an unread event record for the new event to the event store for the subscription; and
sending the unread event record to the first processor and changing the unread event record to a read event record in the event store for the subscription.
18 . The event logging system of claim 17 , wherein the second computer-executable instructions comprise instructions executable by the second processor for pushing the unread event record to the first processor.
19 . The event logging system of claim 17 , wherein the first computer-executable instructions comprise instructions executable by the first processor for pulling the unread event record.
20 . The event logging system of claim 19 , wherein the second computer-executable instructions comprise instructions executable by the second processor for sending the unread event record to the first processor responsive to the first processor pulling the unread event record.
21 . The computer-implemented method of claim 1 , further comprising accessing an output format selection associated with the subscription, the output format selection indicating the output format, wherein the syslog connector comprises a plurality of transformations for translating from the first format used by the cloud source to the plurality of supported syslog formats.
22 . The computer program product of claim 11 , wherein the computer-executable instructions further comprise instructions for accessing an output format selection associated with the subscription, the output format selection indicating the output format.
23 . The event logging system of claim 17 , wherein the first computer-executable instructions comprise instructions for accessing an output format selection associated with the subscription, the output format selection indicating the output format.