Method export

modules/siem/syslog.py:162–200

Export event via Syslog. Args: event: Event to export Returns: True if successful

(self, event: SIEMEvent)

                self._socket.connect((self.host, self.port))

        return self._socket

    async def export(self, event: SIEMEvent) -> bool:
        """Export event via Syslog.

        Args:
            event: Event to export

        Returns:
            True if successful
        """
        message = self._format_message(event)

        # Ensure message ends with newline for TCP
        if self.protocol != "udp" and not message.endswith("\n"):
            message += "\n"

        message_bytes = message.encode("utf-8")

        try:
            # Run blocking socket operations in executor
            loop = asyncio.get_event_loop()

            if self.protocol == "udp":
                await loop.run_in_executor(
                    None,
                    lambda: self._send_udp(message_bytes)
                )
            else:
                await loop.run_in_executor(
                    None,
                    lambda: self._send_tcp(message_bytes)
                )

            self.logger.debug(f"Syslog message sent: {event.event_type}")
            return True

        except Exception as e:
            self.logger.error(f"Syslog export failed: {e}")
            self._socket = None  # Reset socket on error
            return False