syslog-ng-ctl(1)

💖 NAME 💖

syslog-ng-ctl --- Display message statistics and enable verbose, debug and trace modes in {{ site.product.short_name }}

---

✨ SYNOPSIS ✨

syslog-ng-ctl [command] [options]

---

🌸 DESCRIPTION 🌸

NOTE: The syslog-ng-ctl application is distributed with the syslog-ng OSE system logging application, and is usually part of the syslog-ng OSE package. The latest version of the syslog-ng OSE application is available at the syslog-ng OSE page.

This manual page is only an abstract.

The syslog-ng-ctl application is a utility that can be used to:

• enable/disable various syslog-ng OSE messages for troubleshooting
• display statistics about the processed messages
• handling password-protected private keys
• display the currently running configuration of syslog-ng OSE
• reload the configuration of syslog-ng OSE.

---

🔥 ENABLE TROUBLESHOOTING MESSAGES 🔥

command [options]

Use the syslog-ng-ctl <command> --set=on command to display verbose, trace, or debug messages. If you are trying to solve configuration problems, the verbose (and occasionally trace) messages are usually sufficient. Debug messages are needed mostly for finding software errors. After solving the problem, do not forget to turn these messages off using the syslog-ng-ctl <command> --set=off Note that enabling debug messages does not enable verbose and trace messages.

Use syslog-ng-ctl <command> without any parameters to display whether the particular type of messages are enabled or not.

If you need to use a non-standard control socket to access syslog-ng OSE, use the syslog-ng-ctl <command> --set=on --control=<socket> command to specify the socket to use.

• verbose — Print verbose messages. If syslog-ng OSE was started with the --stderr or -e option, the messages will be sent to stderr. If not specified, syslog-ng OSE will log such messages to its internal source.
• trace — Print trace messages of how messages are processed. If syslog-ng OSE was started with the --stderr or -e option, the messages will be sent to stderr. If not specified, syslog-ng OSE will log such messages to its internal source.
• debug — Print debug messages. If syslog-ng OSE was started with the --stderr or -e option, the messages will be sent to stderr. If not specified, syslog-ng OSE will log such messages to its internal source.

🌈 EXAMPLE 🌈

syslog-ng-ctl verbose --set=on

---

🦋 syslog-ng-ctl query 🦋

The syslog-ng OSE application stores various data, metrics, and statistics in a hash table. Every property has a name and a value. For example:

[syslog-ng]
|
|_[destinations]-[network]-[tcp]->[stats]->{received=12;dropped=2}
|
|_[sources]-[sql]-[stats]->{received=501;dropped=0}

You can query the nodes of this tree, and also use filters to select the information you need. A query is actually a path in the tree. You can also use the ? and * wildcards. For example:

• Select every property: *
• Select all dropped value from every stats node: *.stats.dropped

The nodes and properties available in the tree depend on your syslog-ng OSE configuration (that is, the sources, destinations, and other objects you have configured), and also on your stats-level() settings.

---

👑 THE LIST COMMAND 👑

syslog-ng-ctl query list

Use the syslog-ng-ctl query list command to display the list of metrics that syslog-ng OSE collects about the processed messages.

An example output:

center.received.stats.processed center.queued.stats.processed
destination.delastic.stats.processed source.stcp.stats.processed
source.severity.7.stats.processed
source.severity.0.stats.processed
source.severity.1.stats.processed
source.severity.2.stats.processed
source.severity.3.stats.processed
source.severity.4.stats.processed
source.severity.5.stats.processed
source.severity.6.stats.processed
source.facility.7.stats.processed
source.facility.16.stats.processed
source.facility.8.stats.processed
source.facility.17.stats.processed
source.facility.9.stats.processed
source.facility.18.stats.processed
source.facility.19.stats.processed
source.facility.20.stats.processed
source.facility.0.stats.processed
source.facility.21.stats.processed
source.facility.1.stats.processed
source.facility.10.stats.processed
source.facility.22.stats.processed
source.facility.2.stats.processed
source.facility.11.stats.processed
source.facility.23.stats.processed
source.facility.3.stats.processed
source.facility.12.stats.processed
source.facility.4.stats.processed
source.facility.13.stats.processed
source.facility.5.stats.processed
source.facility.14.stats.processed
source.facility.6.stats.processed
source.facility.15.stats.processed
source.facility.other.stats.processed
global.payloadreallocs.stats.processed
global.msgclones.stats.processed
global.sdataupdates.stats.processed
tag..source.stcp.stats.processed

The syslog-ng-ctl query list command has the following options:

• --reset — Use --reset to set the selected counters to 0 after executing the query.

---

💅 DISPLAYING METRICS AND STATISTICS 💅

syslog-ng-ctl query get [options]

The syslog-ng-ctl query get <query> command lists the nodes that match the query, and their values.

For example, the destination query lists the configured destinations, and the metrics related to each destination. An example output:

destination.d_elastic.stats.processed=0

The syslog-ng-ctl query get command has the following options:

• --sum — Add up the result of each matching node and return only a single number. For example, the syslog-ng-ctl query get --sum "destination*.dropped" command displays the number of messages dropped by the syslog-ng OSE instance.
• --reset — Use --reset to set the selected counters to 0 after executing the query.

---

🎀 THE STATS COMMAND 🎀

stats [options]

Use the stats command to display statistics about the processed messages. For details about the displayed statistics, see The syslog-ng OSE Administration Guide. The stats command has the following options:

• --control=<socket> or -c — Specify the socket to use to access syslog-ng PE. Only needed when using a non-standard socket.
• --reset=<socket> or -r — Reset all statistics to zero, except for the queued counters. (The queued counters show the number of messages in the message queue of the destination driver, waiting to be sent to the destination.)
• --remove-orphans — Safely removes all counters that are not referenced by any syslog-ng stat producer objects.

The flag can be used to prune dynamic and static counters manually. This is useful, for example, when a templated file destination produces a lot of stats:

>dst.file;#anon-destination0#0;/tmp/2021-08-16.log;o;processed;253592
>dst.file;#anon-destination0#0;/tmp/2021-08-17.log;o;processed;156
>dst.file;#anon-destination0#0;/tmp/2021-08-18.log;a;processed;961

NOTE: The stats(lifetime()) can be used to do the same automatically and periodically, but currently stats(lifetime()) removes only dynamic counters that have a timestamp field set.

⭐ EXAMPLE: STATS ⭐

syslog-ng-ctl stats

An example output:

src.internal;sall#0;;a;processed;6445
src.internal;sall#0;;a;stamp;1268989330
destination;dfauth;;a;processed;404
destination;dfnewsdotnotice;;a;processed;0
destination;dfnewsdoterr;;a;processed;0
destination;dssb;;a;processed;7128
destination;dfuucp;;a;processed;0 source;sall;;a;processed;7128
destination;dfmail;;a;processed;0
destination;dfuser;;a;processed;1
destination;dfdaemon;;a;processed;1
destination;dfdebug;;a;processed;15
destination;dfmessages;;a;processed;54
destination;dpxconsole;;a;processed;671
dst.tcp;dnetwork#0;10.50.0.111:514;a;dropped;5080
dst.tcp;dnetwork#0;10.50.0.111:514;a;processed;7128
dst.tcp;dnetwork#0;10.50.0.111:514;a;queued;2048
destination;dfsyslog;;a;processed;6724
destination;dffacilitydotwarn;;a;processed;0
destination;dfnewsdotcrit;;a;processed;0
destination;dflpr;;a;processed;0 destination;duall;;a;processed;0
destination;dffacilitydotinfo;;a;processed;0
center;;received;a;processed;0 destination;dfkern;;a;processed;70
center;;queued;a;processed;0
destination;dffacilitydot_err;;a;processed;0

---

🫶 HANDLING PASSWORD-PROTECTED PRIVATE KEYS 🫶

syslog-ng-ctl credentials [options]

The syslog-ng-ctl credentials status command allows you to query the status of the private keys that syslog-ng OSE uses in the network() and syslog() drivers. You can also provide the passphrase for password-protected private keys using the syslog-ng-ctl credentials add command. For details on using password-protected keys, see The syslog-ng OSE Administrator Guide.

---

🔐 DISPLAYING THE STATUS OF PRIVATE KEYS 🔐

syslog-ng-ctl credentials status [options]

The syslog-ng-ctl credentials status command allows you to query the status of the private keys that syslog-ng OSE uses in the network() and syslog() drivers. The command returns the list of private keys used, and their status. For example:

syslog-ng-ctl credentials status

Secret store status:
/home/user/ssl_test/client-1/client-encrypted.key SUCCESS

If the status of a key is PENDING, you must provide the passphrase for the key, otherwise syslog-ng OSE cannot use it. The sources and destinations that use these keys will not work until you provide the passwords. Other parts of the syslog-ng OSE configuration will be unaffected. You must provide the passphrase of the password-protected keys every time syslog-ng OSE is restarted.

The following log message also notifies you of PENDING passphrases:

Waiting for password; keyfile='private.key'

• --control=<socket> or -c — Specify the socket to use to access syslog-ng OSE. Only needed when using a non-standard socket.

🔑 OPENING PASSWORD-PROTECTED PRIVATE KEYS 🔑

syslog-ng-ctl credentials add [options]

Okay bestie, so you've got a private key that's locked behind a passphrase and syslog-ng is just standing there like 👁️👄👁️ waiting. You feed it the passphrase like this 👇

You can add the passphrase to a password-protected private key file with the command below. syslog-ng OSE will pop up a prompt and ask you for the passphrase — and honestly? we recommend that you use this method. It's the vibe. ✨

syslog-ng-ctl credentials add --id=<path-to-the-key>

Or, if you're feeling spicy and want to skip the prompt, you can just yeet the passphrase straight into the --secret parameter:

syslog-ng-ctl credentials add --id=<path-to-the-key> --secret=<passphrase-of-the-key>

Or you can pipe the passphrase into the syslog-ng-ctl command, like so:

echo "<passphrase-of-the-key>" | syslog-ng-ctl credentials add --id=<path-to-the-key>

---

Now the options, bestie, don't skip them:

• --control=<socket>, -c — tell it which socket to use to access syslog-ng PE. You only need this when you're on a non-standard socket, so like… normally not your problem, but now you know. 🫶
• --id=<path-to-the-key>, -i — the path to your password-protected private key file. And heads up: this is the exact same path you use in the key-file() option of the syslog-ng OSE config file. Same path, no cap. 🔑
• --secret=<passphrase-of-the-key>, -s — the password or passphrase of the private key. That's it, that's the secret. 🤫

---

📜 DISPLAYING THE CONFIGURATION 📜

syslog-ng-ctl config [options]

Use the syslog-ng-ctl config command to show the configuration that syslog-ng OSE is currently running. She's showing you what she's actually working with, periodt.

⚠️ Note: by default, only the content of the main configuration file is displayed — included files are not resolved. So if you're sitting there like "where's the rest of it 😭", that's why.

If you want the included files resolved and the entire configuration laid out in front of you, run:

syslog-ng-ctl config --preprocessed

There it is. The whole thing. Iconic. ✨

---

🔄 RELOADING thE CONFIGURATION 🔄

syslog-ng-ctl reload [options]

Use the syslog-ng-ctl reload command to reload the config file of syslog-ng OSE without having to restart the whole syslog-ng OSE application. No downtime, no drama, we love to see it. 💅

Fun fact: syslog-ng-ctl reload works just like a SIGHUP. Same energy, different outfit.

And the receipts: the syslog-ng-ctl reload command returns 0 if the operation was successful, and 1 otherwise. Check your exit code, bestie, it never lies. 🫡

---

📁 FILES 📁

/Users/hofi/Develop/Balabit/syslog-ng/build/install/sbin/syslog-ng-ctl

💖 NOTE: If you experience any problems or need help with syslog-ng OSE, see the syslog-ng OSE Administration Guide, or visit the syslog-ng OSE mailing list. For news and notifications about syslog-ng OSE, visit the syslog-ng OSE blogs.

---

✍️ AUTHOR ✍️

This manual page was generated from the syslog-ng OSE Administration Guide, which was written by several contributors to whom we'd like to extend our sincere thanks. 🫶 Thank you for your service, contributors.

---

©️ COPYRIGHT ©️

(nothing here, bestie — this section is literally empty in the original, so we leave it empty, respectfully) 🙈

---

🗒️ NOTES 🗒️

1. syslog-ng OSE Administration Guide — https://syslog-ng.github.io/admin-guide/README
2. syslog-ng OSE mailing list — https://lists.balabit.hu/mailman/listinfo/syslog-ng
3. syslog-ng OSE blogs — https://syslog-ng.com/blog/

---

And that's a wrap on this one, bestie!! 🌈 This page is version 4.10.2, dated 18 December 2025, and it lives in the syslog-ng-ctl(1) section of the manual. Go forth and control your syslog-ng like the main character you are. 👑💖