syslog-ng documentation

Your main source of knowledge

The syslog-ng product family has an extensive documentation, covering everything from how to install a product to the most complex configuration and settings descriptions. If you cannot find an answer to your question, try the mailing list - our community is always eager to help.

syslog-ng Premium Edition


5.6. Global and environmental variables

Starting with syslog-ng PE version 4 F1, it is possible to define global variables in the configuration file. Global variables are actually name-value pairs. When syslog-ng processes the configuration file during startup, it automatically replaces `name` with value. To define a global variable, use the following syntax:

@define name "value"

The value can be any string, but special characters must be escaped.To use the variable, insert the name of the variable enclosed between backticks (`, similarly to using variables in Linux or UNIX shells) anywhere in the configuration file.

The value of the global variable can be also specified using the following methods:

  • Without any quotes, as long as the value does not contain any spaces or special characters. In other word, it contains only the following characters: a-zA-Z0-9_..

  • Between apostrophes, in case the value does not contain apostrophes.

  • Between double quotes, in which case special characters must be escaped using backslashes (\).


The environmental variables of the host are automatically imported and can be used as global variables.

Example 5.5. Using global variables

For example, if an application is creating multiple log files in a directory, you can store the path in a global variable, and use it in your source definitions.

@define mypath "/opt/myapp/logs"
        source s_myapp_1 { file("`mypath`/access.log" follow-freq(1)); };
        source s_myapp_2 { file("`mypath`/error.log" follow-freq(1)); };
        source s_myapp_3 { file("`mypath`/debug.log" follow-freq(1)); };

The syslog-ng PE application will interpret this as:

@define mypath "/opt/myapp/logs"
        source s_myapp_1 { file("/opt/myapp/logs/access.log" follow-freq(1)); };
        source s_myapp_2 { file("/opt/myapp/logs/error.log" follow-freq(1)); };
        source s_myapp_3 { file("/opt/myapp/logs/debug.log" follow-freq(1)); };