Use this documentation with care! It describes the heavily outdated version 5, which was actively developed around 2010 and is considered dead by the rsyslog team for many years now.

This documentation reflects the latest update of the previously existing (now removed) v5-stable branch. It describes the 5.10.2 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v5 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is no rsyslog community support available for this heavily outdated version. If you need to stick with it, please ask your distribution for support.

imudp: UDP Syslog Input Module

Module Name:imudp
Author:Rainer Gerhards <rgerhards@adiscon.com>
Multi-Ruleset Support:since 5.3.2

Description:

Provides the ability to receive syslog messages via UDP.

Multiple receivers may be configured by specifying $UDPServerRun multiple times.

Configuration Directives:

  • $UDPServerAddress <IP>

    local IP address (or name) the UDP listens should bind to. Use “*” to specify all addresses (the default).

  • $UDPServerRun <port>

    Starts a UDP server on the specified port. Note that this directive must be given, otherwise no server is started and messages will not be received.

  • $UDPServerTimeRequery <nbr-of-times>

    this is a performance optimization. Getting the system time is very costly. With this setting, imudp can be instructed to obtain the precise time only once every n-times. This logic is only activated if messages come in at a very fast rate, so doing less frequent time calls should usually be acceptable. The default value is two, because we have seen that even without optimization the kernel often returns twice the identical time. You can set this value as high as you like, but do so at your own risk. The higher the value, the less precise the timestamp.

  • $InputUDPServerBindRuleset <ruleset>

    Binds the listener to a specific ruleset.

See also:

Caveats/Known Bugs:

  • currently none known

Sample:

This sets up an UPD server on port 514:

$ModLoad imudp # needs to be done just once
$UDPServerRun 514

This documentation is part of the rsyslog project. Copyright © 2009-2014 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.

Previous topic

imtcp: TCP Syslog Input Module

Next topic

imuxsock: Unix Socket Input

This Page