---
title: "Generic Linux services"
url: "https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/nix/generic/"
last_modified: "2026-05-12T12:48:47+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# Generic Linux services

Generic Linux services:
A generic placeholder for program classifications

These classifications include non-vendor specific services and applications commonly found on Linux/Unix hosts.

To onboard such a source to Axoflow, complete the [generic appliance onboarding steps](https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/index.md).

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.vendor) | `nix` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.product) | `generic` |
| `service` | [`meta.service.name`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.service.name) | `bind`, `chronyd`, `cron`, `cupsd`, `dbus-daemon`, `dhcpd`, `dnsmasq`, `dnf`, `dockerd`, `NetworkManager`, `nginx`, `nxlog`, `rsyslogd`, `sshd`, `su`, `sudo`, `syslog-ng`, or `systemd` |

You can use the labels as:

- **Filter labels** on the [Analytics page](https://axoflow.com/docs/axoflow/0.86/metrics/analytics/index.md),
- in the **Filter By Label** field during [log tapping](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| source | sourcetype | index |
| --- | --- | --- |
| `program:chron` | `nix:syslog` | `netops` |
| `program:chronyd` | `nix:syslog` | `netops` |
| `program:cupsd` | `nix:syslog` | `netops` |
| `program:dbus-daemon` | `nix:syslog` | `netops` |
| `program:dhcpd` | `isc:dhcpd` | `netipam` |
| `program:dnf` | `nix:syslog` | `netops` |
| `program:dockerd` | `nix:syslog` | `netops` |
| `program:dnsmasq` | `nix:syslog` | `netdns` |
| `program:named` | `isc:bind:network` | `netdns` |
| `program:NetworkManager` | `nix:syslog` | `netops` |
| `program:nxlog` | `nix:syslog` | `netops` |
| `program:rsyslogd` | `nix:syslog` | `netops` |
| `program:sshd` | `nix:syslog` | `netops` |
| `program:su` | `nix:syslog` | `netauth` |
| `program:sudo` | `nix:syslog` | `netauth` |
| `program:syslog-ng` | `nix:syslog` | `netops` |
| `program:systemd` | `nix:syslog` | `netops` |

Tested with: [Splunk Add-on for Infoblox](https://splunkbase.splunk.com/app/2934/)

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).

## Sending data to Google SecOps

When sending the data collected from this source to a [*dynamic* Google SecOps destination](https://axoflow.com/docs/axoflow/0.86/destinations/google/secops/index.md), Axoflow sets the following log type: `BIND_DNS, ISC_DHCP, NIX_SYSTEM, or OPENSSH`.

## Sending data to Microsoft Sentinel

When sending the data collected from this source to a [Microsoft Sentinel destination](https://axoflow.com/docs/axoflow/0.86/destinations/microsoft/sentinel/index.md), Axoflow normalizes the data and sends it to the following table: `Syslog`.