Index

Symbols

$ActionFileDefaultTemplate $ActionFileEnableSync $ActionOMProgBinary $actionsnmpcommunity $actionsnmpenterpriseoid $actionsnmpspecifictype $actionsnmpsyslogmessageoid $actionsnmptarget $actionsnmptargetport $actionsnmptransport $actionsnmptrapoid $actionsnmptraptype $actionsnmpversion $AddUnixListenSocket $bom $CreateDirs $day $DirCreateMode $DirGroup $DirGroupNum $DirOwner $DirOwnerNum $DynaFileCacheSize $FailOnCHOwnFailure $FileCreateMode $FileGroup $FileGroupNum $FileOwner $FileOwnerNum $hhour $hour $ImjournalDefaultFacility $ImjournalDefaultSeverity $ImjournalIgnorePreviousMessages $imjournalPersistStateInterval $imjournalRatelimitBurst $imjournalRatelimitInterval $imjournalStateFile $IMUDPSchedulingPolicy $IMUDPSchedulingPriority $IMUXSockRateLimitBurst $IMUXSockRateLimitInterval $IMUXSockRateLimitSeverity $InputFileBindRuleset $InputFileFacility $InputFileMaxLinesAtOnce $InputFileName $InputFilePersistStateInterval $InputFileReadMode $InputFileSeverity $InputFileStateFile $InputFileTag $InputPTCPServerAddtlFrameDelimiter $InputPTCPServerBindRuleset $InputPTCPServerHelperThreads $InputPTCPServerInputName $InputPTCPServerKeepAlive $InputPTCPServerKeepAlive_intvl $InputPTCPServerKeepAlive_probes $InputPTCPServerKeepAlive_time

$InputPTCPServerListenIP $InputPTCPServerNotifyOnConnectionClose $InputPTCPServerRun $InputPTCPServerSupportOctetCountedFraming $InputTCPFlowControl $InputTCPMaxListeners $InputTCPMaxSessions $InputTCPServerAddtlFrameDelimiter $InputTCPServerBindRuleset $InputTCPServerDisableLFDelimiter $InputTCPServerInputName $InputTCPServerKeepAlive $InputTCPServerKeepAlive_probes $InputTCPServerKeepAlive_time $InputTCPServerNotifyOnConnectionClose $InputTCPServerRun $InputTCPServerStreamDriverAuthMode $InputTCPServerStreamDriverMode $InputTCPServerStreamDriverPermittedPeer $InputTCPServerSupportOctetCountedFraming $InputUDPServerBindRuleset $InputUnixListenSocketAnnotate $InputUnixListenSocketCreatePath $InputUnixListenSocketFlowControl $InputUnixListenSocketHostName $InputUnixListenSocketIgnoreMsgTimestamp $InputUnixListenSocketUsePIDFromSystem $InputUnixListenSocketUseSysTimeStamp $minute $mmnormalizeRuleBase $mmnormalizeUseRawMsg $mmsnmptrapdSeverityMapping $mmsnmptrapdTag $month $myhostname $now $now-unixtimestamp $OMFileASyncWriting $OMFileFlushInterval $OMFileFlushOnTXEnd $OMFileIOBufferSize $OMFileZipLevel $OmitLocalLogging $outchannel, [1] $ParseTrusted $qhour $SystemLogFlowControl $SystemLogParseTrusted $SystemLogRateLimitBurst $SystemLogRateLimitInterval $SystemLogRateLimitSeverity $SystemLogSocketAnnotate $SystemLogSocketIgnoreMsgTimestamp $SystemLogSocketName $SystemLogUsePIDFromSystem $SystemLogUseSysTimeStamp $UDPServerAddress $UDPServerRun $UDPServerTimeRequery $wday $year

A

action addCeeTag addLF addMetadata Address, [1], [2] AddtlFrameDelimiter, [1] AI First Responsible AI; Golden Path; Guardrails; Safeguards allowRegex

allowunsignedcerts, [1] Annotate annotation_match apiKey apiKeyFile ApiVersionStr app-name appName asyncrepl asyncWriting

B

BatchSize beginTransactionMark binary, [1]

Broker bulkid bulkmode busyretryinterval

C

cacheentryttl cacheexpireinterval CEE cookie Change Log CI GitHub Actions; Buildbot closeTimeout, [1], [2] commitTransactionMark Community compression.driver Compression.mode compression.zstd.workers config.enabled confirmMessages confirmTimeout ConfParam

container, [1], [2] containerrulebase containerrules containers, [1] development images environment-style configuration historical images rsyslog/rsyslog rsyslog/rsyslog-collector rsyslog/rsyslog-dockerlogs rsyslog/rsyslog-minimal user images cookie createDirs CreatePath cry.Provider

D

data pipeline templates de_dot de_dot_separator DefaultFacility, [1] DefaultSeverity, [1] defaultTag DefaultTZ Defaulttz deleteStateOnFileDelete deleteStateOnFileMove detect.headerless detect.YearAfterTimestamp development images containers Device dirCreateMode dirGroup dirGroupNum dirOwner dirOwnerNum DisableLFDelimiter DiscardTruncatedMsg, [1] discardTruncatedMsg

DNS lookup cache timeout dnscacheDefaultTTL dnscacheEnableTTL dnsCacheTTL Docker installation rsyslog images Docker images rsyslog/rsyslog rsyslog/rsyslog-collector rsyslog/rsyslog-dockerlogs rsyslog/rsyslog-minimal DockerApiUnixSockAddr dstmetadatapath dynaFile dynafile.donotsuspend dynaFileCacheSize DynaKey DynaTopic DynaTopic.Cachesize dynbulkid dynParent dynPipelineName dynSearchIndex dynSearchType

E

embeddedIpv4.anonMode embeddedIpv4.bits embeddedIpv4.enable endmsg.regex EnterpriseOID environment variable ENABLE_RELP ENABLE_TCP ENABLE_UDP PERMIT_UNCLEAN_START REMOTE_SERVER_NAME REMOTE_SERVER_PORT RSYSLOG_HOSTNAME RSYSLOG_ROLE WRITE_ALL_FILE WRITE_JSON_FILE

environment variables config.enabled environment-style configuration containers errorFile, [1] escapeLF, [1] escapeLF.replacement esVersion.major expert.initialPrompt

F

Facility failedMsgFile FailOnChOwnFailure failOnChOwnFailure fields, [1] File, [1] FileCreateMode, [1] fileCreateMode, [1] FileGroup fileGroup FileGroupNum fileGroupNum filenamerulebase filenamerules FileOwner fileOwner

FileOwnerNum fileOwnerNum filtercode FlowControl, [1] flowControl flushInterval flushOnTXEnd force.tagEndingByColon forceLocalHostname forceSingleInstance, [1] framing.delimiter.regex Framingfix.cisco.asa freshStartTail fromhost fromhost-ip fromhost-port FSync

G

GetContainerLogOptions gnutlsPriorityString

Golden Path Guardrails

H

hashFunction headerless.drop headerless.errorfile headerless.hostname headerless.ruleset headerless.tag

HealthCheckTimeout historical images containers HostName hostname hup.signal

I

IgnoreNonValidStatefile ignoreOlderThan IgnoreOwnMessages IgnorePreviousMessages IgnoreTimestamp imczmq imdocker ApiVersionStr DefaultFacility DefaultSeverity DockerApiUnixSockAddr escapeLF GetContainerLogOptions ListContainersOptions PollingInterval RetrieveNewLogsFromStart imfile $InputFileBindRuleset $InputFileFacility $InputFileMaxLinesAtOnce $InputFileName $InputFilePersistStateInterval $InputFileReadMode $InputFileSeverity $InputFileStateFile $InputFileTag addCeeTag addMetadata deleteStateOnFileDelete deleteStateOnFileMove discardTruncatedMsg endmsg.regex escapeLF escapeLF.replacement Facility File freshStartTail ignoreOlderThan MaxBytesPerMinute MaxLinesAtOnce MaxLinesPerMinute MaxSubmitAtOnce Mode msgDiscardingError needParse persistStateAfterSubmission PersistStateInterval PollingInterval readMode readTimeout removeStateOnDelete reopenOnTruncate Ruleset Severity sortFiles startmsg.regex stateFile statefile.directory Tag timeoutGranularity trimLineOverBytes imjournal $ImjournalDefaultFacility $ImjournalDefaultSeverity $ImjournalIgnorePreviousMessages $imjournalPersistStateInterval $imjournalRatelimitBurst $imjournalRatelimitInterval $imjournalStateFile DefaultFacility DefaultSeverity defaultTag FileCreateMode FSync IgnoreNonValidStatefile IgnorePreviousMessages Main PersistStateInterval Ratelimit.Burst Ratelimit.Interval Remote StateFile UsePid UsePidFromSystem WorkAroundJournalBug imptcp $InputPTCPServerAddtlFrameDelimiter $InputPTCPServerBindRuleset $InputPTCPServerHelperThreads $InputPTCPServerInputName $InputPTCPServerKeepAlive $InputPTCPServerKeepAlive_intvl $InputPTCPServerKeepAlive_probes $InputPTCPServerKeepAlive_time $InputPTCPServerListenIP $InputPTCPServerNotifyOnConnectionClose $InputPTCPServerRun $InputPTCPServerSupportOctetCountedFraming Address AddtlFrameDelimiter Compression.mode Defaulttz DiscardTruncatedMsg FailOnChOwnFailure FileCreateMode FileGroup FileGroupNum FileOwner FileOwnerNum flowControl framing.delimiter.regex Framingfix.cisco.asa KeepAlive KeepAlive.Interval KeepAlive.Probes KeepAlive.Time ListenPortFileName MaxFrameSize MaxSessions MultiLine Name NotifyOnConnectionClose NotifyOnConnectionOpen Path Port ProcessOnPoller RateLimit.Burst RateLimit.Interval Ruleset SocketBacklog SupportOctetCountedFraming Threads Unlink imtcp $InputTCPFlowControl $InputTCPMaxListeners $InputTCPMaxSessions $InputTCPServerAddtlFrameDelimiter $InputTCPServerBindRuleset $InputTCPServerDisableLFDelimiter $InputTCPServerInputName $InputTCPServerKeepAlive $InputTCPServerKeepAlive_probes $InputTCPServerKeepAlive_time $InputTCPServerNotifyOnConnectionClose $InputTCPServerRun $InputTCPServerStreamDriverAuthMode $InputTCPServerStreamDriverMode $InputTCPServerStreamDriverPermittedPeer $InputTCPServerSupportOctetCountedFraming Address AddtlFrameDelimiter conditional loading DisableLFDelimiter DiscardTruncatedMsg FlowControl gnutlsPriorityString KeepAlive KeepAlive.Interval KeepAlive.Probes KeepAlive.Time ListenPortFileName MaxFrameSize MaxListeners MaxSessions Name NotifyOnConnectionClose NotifyOnConnectionOpen PermittedPeer Port PreserveCase RateLimit.Burst RateLimit.Interval Ruleset SocketBacklog StarvationProtection.MaxReads StreamDriver.AuthMode streamDriver.CAFile streamDriver.CertFile StreamDriver.checkExtendedKeyPurpose streamDriver.CRLFile streamDriver.KeyFile StreamDriver.Mode StreamDriver.Name StreamDriver.PermitExpiredCerts StreamDriver.PrioritizeSAN StreamDriver.TlsVerifyDepth SupportOctetCountedFraming WorkerThreads

imudp, [1] $IMUDPSchedulingPolicy $IMUDPSchedulingPriority $InputUDPServerBindRuleset $UDPServerAddress $UDPServerRun $UDPServerTimeRequery Address BatchSize DefaultTZ Device input parameters IpFreeBind module parameters Name Name.appendPort Port PreserveCase RateLimit.Burst RateLimit.Interval RcvBufSize Ruleset SchedulingPolicy SchedulingPriority Threads TimeRequery imuxsock $AddUnixListenSocket $IMUXSockRateLimitBurst $IMUXSockRateLimitInterval $IMUXSockRateLimitSeverity $InputUnixListenSocketAnnotate $InputUnixListenSocketCreatePath $InputUnixListenSocketFlowControl $InputUnixListenSocketHostName $InputUnixListenSocketIgnoreMsgTimestamp $InputUnixListenSocketUsePIDFromSystem $InputUnixListenSocketUseSysTimeStamp $OmitLocalLogging $ParseTrusted $SystemLogFlowControl $SystemLogParseTrusted $SystemLogRateLimitBurst $SystemLogRateLimitInterval $SystemLogRateLimitSeverity $SystemLogSocketAnnotate $SystemLogSocketIgnoreMsgTimestamp $SystemLogSocketName $SystemLogUsePIDFromSystem $SystemLogUseSysTimeStamp Annotate CreatePath FlowControl HostName IgnoreOwnMessages IgnoreTimestamp ParseHostname ParseTrusted RateLimit.Burst RateLimit.Interval RateLimit.Severity Ruleset Socket SysSock.Annotate SysSock.FlowControl SysSock.IgnoreOwnMessages SysSock.IgnoreTimestamp SysSock.Name SysSock.ParseHostname SysSock.ParseTrusted SysSock.RateLimit.Burst SysSock.RateLimit.Interval SysSock.RateLimit.Severity SysSock.Unlink SysSock.Use SysSock.UsePIDFromSystem SysSock.UseSpecialParser SysSock.UseSysTimeStamp Unlink UsePIDFromSystem UseSpecialParser UseSysTimeStamp indexTimeout input, [1], [2] inputname inputProperty installation Docker interface.input ioBufferSize IpFreeBind ipv4.bits ipv4.enable ipv4.mode ipv4.replaceChar ipv6.anonMode ipv6.bits ipv6.enable iut

J

JSON container jsonmesg

jsonRoot jsonroot

K

KafkaHeader KeepAlive, [1] KeepAlive.Interval, [1] KeepAlive.Probes, [1] KeepAlive.Time, [1]

KeepFailedMessages Key key, [1], [2], [3] killUnresponsive KubernetesURL

L

ListContainersOptions

ListenPortFileName, [1]

M

Main maxbytes MaxBytesPerMinute MaxFrameSize, [1] MaxLinesAtOnce MaxLinesPerMinute MaxListeners MaxSessions, [1] MaxSubmitAtOnce MessageOID mmaitag apiKey apiKeyFile expert.initialPrompt inputProperty model provider tag mmanon embeddedIpv4.anonMode embeddedIpv4.bits embeddedIpv4.enable ipv4.bits ipv4.enable ipv4.mode ipv4.replaceChar ipv6.anonMode ipv6.bits ipv6.enable mode replacementchar mmcount appName key value mmdarwin container fields filtercode key response send_partial socketpath mmdbfile mmdblookup container fields key mmdbfile reloadonhup mmexternal binary forceSingleInstance interface.input output mmfields jsonroot separator mmjsonparse container cookie useRawMsg userawmsg

mmjsonrewrite input output mmjsontransform input mode output mmkubernetes allowunsignedcerts annotation_match busyretryinterval cacheentryttl cacheexpireinterval containerrulebase containerrules de_dot de_dot_separator dstmetadatapath filenamerulebase filenamerules KubernetesURL skipverifyhost srcmetadatapath sslpartialchain tls.cacert tls.mycert tls.myprivkey token tokenfile mmnormalize $mmnormalizeRuleBase $mmnormalizeUseRawMsg allowRegex path rule ruleBase useRawMsg variable mmpstrucdata jsonRoot sd_name.lowercase mmrfc5424addhmac hashFunction key sdId mmsnmptrapd $mmsnmptrapdSeverityMapping $mmsnmptrapdTag severityMapping tag mmtaghostname forceLocalHostname tag mmutf8fix mode replacementChar Mode mode, [1], [2] model msg msgDiscardingError msgid MultiLine

N

Name, [1], [2] Name.appendPort

needParse NotifyOnConnectionClose, [1] NotifyOnConnectionOpen, [1]

O

omczmq omelasticsearch allowunsignedcerts asyncrepl bulkid bulkmode dynbulkid dynParent dynPipelineName dynSearchIndex dynSearchType errorFile esVersion.major HealthCheckTimeout indexTimeout maxbytes parent pipelineName pwd ratelimit.burst ratelimit.interval rebindinterval retryfailures retryruleset searchIndex searchType Server Serverport skipPipelineIfEmpty skipverifyhost template timeout tls.cacert tls.mycert tls.myprivkey uid usehttps writeoperation omfile $ActionFileDefaultTemplate $ActionFileEnableSync $CreateDirs $DirCreateMode $DirGroup $DirGroupNum $DirOwner $DirOwnerNum $DynaFileCacheSize $FailOnCHOwnFailure $FileCreateMode $FileGroup $FileGroupNum $FileOwner $FileOwnerNum $OMFileASyncWriting $OMFileFlushInterval $OMFileFlushOnTXEnd $OMFileIOBufferSize $OMFileZipLevel $outchannel, [1] addLF asyncWriting closeTimeout compression.driver compression.zstd.workers createDirs cry.Provider dirCreateMode dirGroup dirGroupNum dirOwner dirOwnerNum dynaFile dynafile.donotsuspend dynaFileCacheSize failOnChOwnFailure File fileCreateMode fileGroup fileGroupNum fileOwner fileOwnerNum flushInterval flushOnTXEnd ioBufferSize rotation.sizeLimit rotation.sizeLimitCommand sig.Provider sync Template veryRobustZip zipLevel

omkafka Broker closeTimeout ConfParam DynaKey DynaTopic DynaTopic.Cachesize errorFile failedMsgFile KafkaHeader KeepFailedMessages Key Partitions.Auto Partitions.number Partitions.useFixed resubmitOnFailure statsFile statsName Template Topic TopicConfParam ompgsql omprog $ActionOMProgBinary beginTransactionMark binary closeTimeout commitTransactionMark confirmMessages confirmTimeout fileCreateMode forceSingleInstance hup.signal killUnresponsive output reportFailures signalOnClose template useTransactions omsendertrack omsnmp $actionsnmpcommunity $actionsnmpenterpriseoid $actionsnmpspecifictype $actionsnmpsyslogmessageoid $actionsnmptarget $actionsnmptargetport $actionsnmptransport $actionsnmptrapoid $actionsnmptraptype $actionsnmpversion Community EnterpriseOID MessageOID Port Server Snmpv1DynSource SpecificType Transport TrapOID TrapType Version Operational Rules Contribution Policy output, [1], [2], [3]

P

parent ParseHostname parser ParseTrusted Partitions.Auto Partitions.number Partitions.useFixed Path path permit.AtSignsInHostname permit.slashesInHostname permit.squareBracketsInHostname PermittedPeer persistStateAfterSubmission PersistStateInterval, [1] pipelineName pmrfc3164 detect.headerless detect.YearAfterTimestamp force.tagEndingByColon headerless.drop headerless.errorfile headerless.hostname headerless.ruleset headerless.tag permit.AtSignsInHostname permit.slashesInHostname permit.squareBracketsInHostname remove.msgFirstSpace PollingInterval, [1] Port, [1], [2], [3] PreserveCase, [1] pri pri-text ProcessOnPoller procid programname properties $bom $day $hhour $hour $minute $month $myhostname $now $now-unixtimestamp $qhour $wday $year app-name fromhost fromhost-ip fromhost-port hostname inputname iut jsonmesg msg msgid pri pri-text procid programname protocol-version rawmsg rawmsg-after-pri source structured-data syslogfacility syslogfacility-text syslogpriority syslogpriority-text syslogseverity syslogseverity-text syslogtag timegenerated timereported timestamp uuid

protocol-version provider pwd

Q

queues backpressure batching suspend/resume worker threads

R

RateLimit.Burst, [1], [2], [3] Ratelimit.Burst ratelimit.burst RateLimit.Interval, [1], [2], [3] Ratelimit.Interval ratelimit.interval RateLimit.Severity rawmsg rawmsg-after-pri RcvBufSize readMode readTimeout rebindinterval reloadonhup Remote remove.msgFirstSpace removeStateOnDelete reopenOnTruncate replacementChar replacementchar reportFailures response resubmitOnFailure RetrieveNewLogsFromStart retryfailures retryruleset

reverse DNS cache reverse DNS refresh RFC RFC 3164, [1], [2] RFC 3195 RFC 5424, [1], [2], [3] Roles Human-in-Control rotation.sizeLimit rotation.sizeLimitCommand rsyslog images Docker rsyslog/rsyslog containers Docker images rsyslog/rsyslog-collector containers Docker images rsyslog/rsyslog-dockerlogs containers Docker images rsyslog/rsyslog-minimal containers Docker images rule ruleBase Ruleset, [1], [2], [3], [4]

S

Safeguards SchedulingPolicy SchedulingPriority schema mapping templates sd_name.lowercase sdId searchIndex searchType send_partial separator Server, [1] Serverport Severity severityMapping sig.Provider signalOnClose skipPipelineIfEmpty skipverifyhost, [1] Snmpv1DynSource Socket SocketBacklog, [1] socketpath sortFiles source SpecificType srcmetadatapath sslpartialchain startmsg.regex StarvationProtection.MaxReads StateFile stateFile statefile.directory statsFile statsName StreamDriver.AuthMode

streamDriver.CAFile streamDriver.CertFile StreamDriver.checkExtendedKeyPurpose streamDriver.CRLFile streamDriver.KeyFile StreamDriver.Mode StreamDriver.Name StreamDriver.PermitExpiredCerts StreamDriver.PrioritizeSAN StreamDriver.TlsVerifyDepth structured-data SupportOctetCountedFraming, [1] sync syslogfacility syslogfacility-text syslogpriority syslogpriority-text syslogseverity syslogseverity-text syslogtag SysSock.Annotate SysSock.FlowControl SysSock.IgnoreOwnMessages SysSock.IgnoreTimestamp SysSock.Name SysSock.ParseHostname SysSock.ParseTrusted SysSock.RateLimit.Burst SysSock.RateLimit.Interval SysSock.RateLimit.Severity SysSock.Unlink SysSock.Use SysSock.UsePIDFromSystem SysSock.UseSpecialParser SysSock.UseSysTimeStamp systemd environment variables

T

Tag tag, [1], [2] Template, [1] template, [1] type=list type=subtree templates list type overview subtree type Threads, [1] timegenerated timeout timeoutGranularity

timereported TimeRequery timestamp timezone tls.cacert, [1] tls.mycert, [1] tls.myprivkey, [1] token tokenfile Topic TopicConfParam Transport TrapOID TrapType trimLineOverBytes

U

uid Unlink, [1] usehttps UsePid UsePIDFromSystem UsePidFromSystem user images containers

useRawMsg, [1] userawmsg UseSpecialParser UseSysTimeStamp useTransactions uuid

V

value variable

Version veryRobustZip Visible Artifacts

W

WorkAroundJournalBug

WorkerThreads writeoperation

Z

zipLevel