Naturally Pacifist Marsupials

    DefinitelyTyped icon, indicating that this package has TypeScript declarations provided by the separate @types/winston-syslog package

    2.6.0 • Public • Published


    A Syslog transport for winston.

    Version npm npm Downloads build status



    • winston >= 3.0.0


    Installing npm (node package manager)

      $ curl | sh

    Installing winston-syslog

      $ npm install winston
      $ npm install winston-syslog


    tldr;?: To break the winston codebase into small modules that work together.

    The winston codebase has been growing significantly with contributions and other logging transports. This is awesome. However, taking a ton of additional dependencies just to do something simple like logging to the Console and a File is overkill.


    To use the Syslog transport in winston, you simply need to require it and then either add it to an existing winston logger or pass an instance to a new winston logger:

      const winston = require('winston');
      // Requiring `winston-syslog` will expose
      // `winston.transports.Syslog`
      winston.add(new winston.transports.Syslog(options));

    In addition to the options accepted by the syslog (compliant with RFC 3164 and RFC 5424), the Riak transport also accepts the following options. It is worth noting that the riak-js debug option is set to false by default:

    • host: The host running syslogd, defaults to localhost.
    • port: The port on the host that syslog is running on, defaults to syslogd's default port.
    • protocol: The network protocol to log over (e.g. tcp4, udp4, tls4, unix, unix-connect, etc), defaults to udp4.
    • protocolOptions: Socket connect options. See net.socket.connect for available options.
    • path: The path to the syslog dgram socket (i.e. /dev/log or /var/run/syslog for OS X).
    • pid: PID of the process that log messages are coming from (Default
    • facility: Syslog facility to use (Default: local0).
    • localhost: Host to indicate that log messages are coming from (Default: localhost).
    • type: The type of the syslog protocol to use (Default: BSD, also valid: '3164', '5424', 'RFC3164' or 'RFC5424').
    • app_name: The name of the application (Default: process.title).
    • eol: The end of line character to be added to the end of the message (Default: Message without modifications).
    • secureProtocol: See for more information on this option, passed through from this constructor.
    • ciphers: See for more information on this option, passed through from this constructor.
    • ecdhCurve: See for more information on this option, passed through from this constructor.

    Metadata: Logged as string compiled by glossy.

    By default, syslog messages are produced by glossy, but you can override that behavior by providing a custom Producer instance via the customProducer setting.

    Log Levels

    Because syslog only allows a subset of the levels available in winston, levels that do not match will be ignored. Therefore, in order to use winston-syslog effectively, you should indicate to winston that you want to use the syslog levels:

      const winston = require('winston');
      const logger = winston.createLogger({
        levels: winston.config.syslog.levels,
        transports: [
          new winston.transports.Syslog()

    The Syslog transport will only log to the level that are available in the syslog protocol. These are (in increasing order of severity):

    • debug
    • info
    • notice
    • warning
    • err
    • crit
    • alert
    • emerg

    Syslog Configuration

    You will have to configure your syslog server to accept TCP or UDP connections. This is usually done in /etc/syslog-ng.conf. Let's say you have an app called fnord and want to use TCP, the configuration would look something like this:

      source tcp_s {
        tcp(ip( port(514) max-connections(256));
      destination fnord_d {
      log { source(tcp_s); destination(fnord_d); };

    If you have multiple apps which need to log via TCP, you can specify filters, as such:

      filter fnord_f { program("fnord"); };

    Then modify the log statement to read:

      log { source(tcp_s); filter(fnord_f); destination(fnord_d); };

    Now if you have another app, called bnord, create similar destination and filter configurations for it, and specify a new log statement, with the same source:

      log { source(tcp_s); filter(bnord_f); destination(bnord_d); };

    For this to work, you have to make sure you set the process.title variable in your node app.

      process.title = 'fnord';

    Author: Charlie Robbins

    Contributors: Squeeks


    npm i winston-syslog

    DownloadsWeekly Downloads






    Unpacked Size

    38.2 kB

    Total Files


    Last publish


    • julien51
    • chjj
    • sgimeno
    • indexzero
    • dabh