imptcp: Plain TCP Syslog¶

Module Name:	imptcp
Author:	Rainer Gerhards <rgerhards@adiscon.com>

Purpose¶

Provides the ability to receive syslog messages via plain TCP syslog. This is a specialized input plugin tailored for high performance on Linux. It will probably not run on any other platform. Also, it does not provide TLS services. Encryption can be provided by using stunnel.

This module has no limit on the number of listeners and sessions that can be used.

Note

Reverse DNS lookups for remote senders are cached. Set the TTL via Reverse DNS caching.

Configuration Parameters¶

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

Module Parameters¶

Parameter	Summary
Threads	Sets the number of helper threads that pull data off the network.
MaxSessions	Limits the number of open sessions.
ProcessOnPoller	Processes messages on the poller thread when feasible to reduce resource use.

Input Parameters¶

These parameters can be used with the “input()” statement. They apply to the input they are specified with.

Parameter	Summary
Port	Selects the TCP port on which to listen.
Path	Specifies a Unix-domain socket path for the listener.
DiscardTruncatedMsg	Discards the remaining part of a message after truncation.
FileOwner	Sets the owner of the Unix-domain socket by user name.
FileOwnerNum	Sets the owner of the Unix-domain socket by numeric UID.
FileGroup	Sets the group of the Unix-domain socket by group name.
FileGroupNum	Sets the group of the Unix-domain socket by numeric GID.
FileCreateMode	Sets access permissions for the Unix-domain socket.
FailOnChOwnFailure	Controls startup failure if changing socket owner, group, or mode fails.
Unlink	Unlinks a Unix-domain socket before listening and after closing.
Name	Sets the inputname property used for tagging messages and statistics.
Ruleset	Binds the specified ruleset to this input.
MaxFrameSize	Sets the maximum frame size when using octet counted mode.
MaxSessions	Limits the number of open sessions.
Address	Specifies the local address to bind the listener to.
AddtlFrameDelimiter	Defines an additional ASCII frame delimiter for non-standard senders.
SupportOctetCountedFraming	Enables legacy octet-counted framing similar to RFC5425.
NotifyOnConnectionClose	Emits a message when a remote peer closes the connection.
NotifyOnConnectionOpen	Emits a message when a remote peer opens a connection.
KeepAlive	Enables TCP keep-alive packets on the socket.
KeepAlive.Probes	Sets the number of unacknowledged keepalive probes before the connection is considered dead.
KeepAlive.Interval	Sets the interval between keepalive probes.
KeepAlive.Time	Sets idle time before the first keepalive probe is sent.
RateLimit.Interval	Specifies the rate-limiting interval in seconds.
RateLimit.Burst	Sets the rate-limiting burst size in number of messages.
Compression.mode	Selects decompression mode matching compression used by omfwd.
flowControl	Throttles the sender when the receiver queue is nearly full.
MultiLine	Detects a new message only when LF is followed by ‘<’ or end of input.
framing.delimiter.regex	Uses a regular expression to identify the start of the next message.
SocketBacklog	Sets the listen() backlog for pending TCP connections.
Defaulttz	Sets a default time zone string.
Framingfix.cisco.asa	Ignores a leading space after a line feed to work around Cisco ASA framing issues.
ListenPortFileName	Writes the port number being listened on into the specified file.

Statistic Counter¶

This plugin maintains statistics for each listener. The statistic is named “imtcp” , followed by the bound address, listener port and IP version in parenthesis. For example, the counter for a listener on port 514, bound to all interfaces and listening on IPv6 is called “imptcp(*/514/IPv6)”.

The following properties are maintained for each listener:

submitted - total number of messages submitted for processing since startup

Error Messages¶

When a message is to long it will be truncated and an error will show the remaining length of the message and the beginning of it. It will be easier to comprehend the truncation.

Caveats/Known Bugs¶

module always binds to all interfaces

Examples¶

Example 1¶

This sets up a TCP server on port 514:

module(load="imptcp") # needs to be done just once
input(type="imptcp" port="514")

Example 2¶

This creates a listener that listens on the local loopback interface, only.

module(load="imptcp") # needs to be done just once
input(type="imptcp" port="514" address="127.0.0.1")

Example 3¶

Create a unix domain socket:

module(load="imptcp") # needs to be done just once
input(type="imptcp" path="/tmp/unix.sock" unlink="on")

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project