Index

Symbols

$ActionFileDefaultTemplate $ActionFileEnableSync $ActionOMProgBinary $actionsnmpcommunity $actionsnmpenterpriseoid $actionsnmpspecifictype $actionsnmpsyslogmessageoid $actionsnmptarget $actionsnmptargetport $actionsnmptransport $actionsnmptrapoid $actionsnmptraptype $actionsnmpversion $AddUnixListenSocket $CreateDirs $DirCreateMode $DirGroup $DirGroupNum $DirOwner $DirOwnerNum $DynaFileCacheSize $FailOnCHOwnFailure $FileCreateMode $FileGroup $FileGroupNum $FileOwner $FileOwnerNum $ImjournalDefaultFacility $ImjournalDefaultSeverity $ImjournalIgnorePreviousMessages $imjournalPersistStateInterval $imjournalRatelimitBurst $imjournalRatelimitInterval $imjournalStateFile $IMUDPSchedulingPolicy $IMUDPSchedulingPriority $IMUXSockRateLimitBurst $IMUXSockRateLimitInterval $IMUXSockRateLimitSeverity $InputFileBindRuleset $InputFileFacility $InputFileMaxLinesAtOnce $InputFileName $InputFilePersistStateInterval $InputFileReadMode $InputFileSeverity $InputFileStateFile $InputFileTag $InputPTCPServerAddtlFrameDelimiter $InputPTCPServerBindRuleset $InputPTCPServerHelperThreads $InputPTCPServerInputName $InputPTCPServerKeepAlive $InputPTCPServerKeepAlive_intvl

$InputPTCPServerKeepAlive_probes $InputPTCPServerKeepAlive_time $InputPTCPServerListenIP $InputPTCPServerNotifyOnConnectionClose $InputPTCPServerRun $InputPTCPServerSupportOctetCountedFraming $InputTCPFlowControl $InputTCPMaxListeners $InputTCPMaxSessions $InputTCPServerAddtlFrameDelimiter $InputTCPServerBindRuleset $InputTCPServerDisableLFDelimiter $InputTCPServerInputName $InputTCPServerKeepAlive $InputTCPServerKeepAlive_probes $InputTCPServerKeepAlive_time $InputTCPServerNotifyOnConnectionClose $InputTCPServerRun $InputTCPServerStreamDriverAuthMode $InputTCPServerStreamDriverMode $InputTCPServerStreamDriverPermittedPeer $InputTCPServerSupportOctetCountedFraming $InputUDPServerBindRuleset $InputUnixListenSocketAnnotate $InputUnixListenSocketCreatePath $InputUnixListenSocketFlowControl $InputUnixListenSocketHostName $InputUnixListenSocketIgnoreMsgTimestamp $InputUnixListenSocketUsePIDFromSystem $InputUnixListenSocketUseSysTimeStamp $mmnormalizeRuleBase $mmnormalizeUseRawMsg $mmsnmptrapdSeverityMapping $mmsnmptrapdTag $OMFileASyncWriting $OMFileFlushInterval $OMFileFlushOnTXEnd $OMFileIOBufferSize $OMFileZipLevel $OmitLocalLogging $outchannel, [1] $ParseTrusted $SystemLogFlowControl $SystemLogParseTrusted $SystemLogRateLimitBurst $SystemLogRateLimitInterval $SystemLogRateLimitSeverity $SystemLogSocketAnnotate $SystemLogSocketIgnoreMsgTimestamp $SystemLogSocketName $SystemLogUsePIDFromSystem $SystemLogUseSysTimeStamp $UDPServerAddress $UDPServerRun $UDPServerTimeRequery

A

action addCeeTag addMetadata Address, [1], [2] AddtlFrameDelimiter, [1] AI First Responsible AI; Golden Path; Guardrails; Safeguards

allowRegex allowunsignedcerts, [1] Annotate annotation_match ApiVersionStr asyncrepl asyncWriting

B

BatchSize beginTransactionMark binary

Broker bulkid bulkmode busyretryinterval

C

cacheentryttl cacheexpireinterval Change Log CI GitHub Actions; Buildbot closeTimeout, [1], [2] commitTransactionMark Community compression.driver Compression.mode compression.zstd.workers config.enabled confirmMessages confirmTimeout

ConfParam containerrulebase containerrules containers, [1] development images environment-style configuration historical images rsyslog/rsyslog rsyslog/rsyslog-collector rsyslog/rsyslog-dockerlogs rsyslog/rsyslog-minimal user images createDirs CreatePath cry.Provider

D

de_dot de_dot_separator DefaultFacility, [1] DefaultSeverity, [1] defaultTag DefaultTZ Defaulttz deleteStateOnFileDelete deleteStateOnFileMove detect.headerless detect.YearAfterTimestamp development images containers Device dirCreateMode dirGroup dirGroupNum dirOwner dirOwnerNum DisableLFDelimiter DiscardTruncatedMsg, [1] discardTruncatedMsg DNS lookup cache timeout

dnscacheDefaultTTL dnscacheEnableTTL dnsCacheTTL Docker installation rsyslog images Docker images rsyslog/rsyslog rsyslog/rsyslog-collector rsyslog/rsyslog-dockerlogs rsyslog/rsyslog-minimal DockerApiUnixSockAddr dstmetadatapath dynaFile dynafile.donotsuspend dynaFileCacheSize DynaKey DynaTopic DynaTopic.Cachesize dynbulkid dynParent dynPipelineName dynSearchIndex dynSearchType

E

endmsg.regex EnterpriseOID environment variable ENABLE_RELP ENABLE_TCP ENABLE_UDP PERMIT_UNCLEAN_START REMOTE_SERVER_NAME REMOTE_SERVER_PORT RSYSLOG_HOSTNAME RSYSLOG_ROLE WRITE_ALL_FILE WRITE_JSON_FILE

environment variables config.enabled environment-style configuration containers errorFile, [1] escapeLF, [1] escapeLF.replacement esVersion.major

F

Facility failedMsgFile FailOnChOwnFailure failOnChOwnFailure File, [1] FileCreateMode, [1] fileCreateMode, [1] FileGroup fileGroup FileGroupNum fileGroupNum filenamerulebase filenamerules FileOwner

fileOwner FileOwnerNum fileOwnerNum FlowControl, [1] flowControl flushInterval flushOnTXEnd force.tagEndingByColon forceLocalHostname forceSingleInstance framing.delimiter.regex Framingfix.cisco.asa freshStartTail FSync

G

GetContainerLogOptions gnutlsPriorityString

Golden Path Guardrails

H

hashFunction headerless.drop headerless.errorfile headerless.hostname headerless.ruleset

headerless.tag HealthCheckTimeout historical images containers HostName hup.signal

I

IgnoreNonValidStatefile ignoreOlderThan IgnoreOwnMessages IgnorePreviousMessages IgnoreTimestamp imczmq imdocker ApiVersionStr DefaultFacility DefaultSeverity DockerApiUnixSockAddr escapeLF GetContainerLogOptions ListContainersOptions PollingInterval RetrieveNewLogsFromStart imfile $InputFileBindRuleset $InputFileFacility $InputFileMaxLinesAtOnce $InputFileName $InputFilePersistStateInterval $InputFileReadMode $InputFileSeverity $InputFileStateFile $InputFileTag addCeeTag addMetadata deleteStateOnFileDelete deleteStateOnFileMove discardTruncatedMsg endmsg.regex escapeLF escapeLF.replacement Facility File freshStartTail ignoreOlderThan MaxBytesPerMinute MaxLinesAtOnce MaxLinesPerMinute MaxSubmitAtOnce Mode msgDiscardingError needParse persistStateAfterSubmission PersistStateInterval PollingInterval readMode readTimeout removeStateOnDelete reopenOnTruncate Ruleset Severity sortFiles startmsg.regex stateFile statefile.directory Tag timeoutGranularity trimLineOverBytes imjournal $ImjournalDefaultFacility $ImjournalDefaultSeverity $ImjournalIgnorePreviousMessages $imjournalPersistStateInterval $imjournalRatelimitBurst $imjournalRatelimitInterval $imjournalStateFile DefaultFacility DefaultSeverity defaultTag FileCreateMode FSync IgnoreNonValidStatefile IgnorePreviousMessages Main PersistStateInterval Ratelimit.Burst Ratelimit.Interval Remote StateFile UsePid UsePidFromSystem WorkAroundJournalBug imptcp $InputPTCPServerAddtlFrameDelimiter $InputPTCPServerBindRuleset $InputPTCPServerHelperThreads $InputPTCPServerInputName $InputPTCPServerKeepAlive $InputPTCPServerKeepAlive_intvl $InputPTCPServerKeepAlive_probes $InputPTCPServerKeepAlive_time $InputPTCPServerListenIP $InputPTCPServerNotifyOnConnectionClose $InputPTCPServerRun $InputPTCPServerSupportOctetCountedFraming Address AddtlFrameDelimiter Compression.mode Defaulttz DiscardTruncatedMsg FailOnChOwnFailure FileCreateMode FileGroup FileGroupNum FileOwner FileOwnerNum flowControl framing.delimiter.regex Framingfix.cisco.asa KeepAlive KeepAlive.Interval KeepAlive.Probes KeepAlive.Time ListenPortFileName MaxFrameSize MaxSessions MultiLine Name NotifyOnConnectionClose NotifyOnConnectionOpen Path Port ProcessOnPoller RateLimit.Burst RateLimit.Interval Ruleset SocketBacklog SupportOctetCountedFraming Threads Unlink imtcp $InputTCPFlowControl $InputTCPMaxListeners $InputTCPMaxSessions $InputTCPServerAddtlFrameDelimiter $InputTCPServerBindRuleset $InputTCPServerDisableLFDelimiter $InputTCPServerInputName $InputTCPServerKeepAlive $InputTCPServerKeepAlive_probes $InputTCPServerKeepAlive_time $InputTCPServerNotifyOnConnectionClose $InputTCPServerRun $InputTCPServerStreamDriverAuthMode $InputTCPServerStreamDriverMode $InputTCPServerStreamDriverPermittedPeer $InputTCPServerSupportOctetCountedFraming Address AddtlFrameDelimiter conditional loading DisableLFDelimiter DiscardTruncatedMsg FlowControl gnutlsPriorityString KeepAlive KeepAlive.Interval KeepAlive.Probes KeepAlive.Time ListenPortFileName MaxFrameSize MaxListeners MaxSessions Name NotifyOnConnectionClose NotifyOnConnectionOpen PermittedPeer Port PreserveCase RateLimit.Burst RateLimit.Interval Ruleset SocketBacklog StarvationProtection.MaxReads StreamDriver.AuthMode streamDriver.CAFile streamDriver.CertFile StreamDriver.checkExtendedKeyPurpose streamDriver.CRLFile streamDriver.KeyFile StreamDriver.Mode StreamDriver.Name StreamDriver.PermitExpiredCerts StreamDriver.PrioritizeSAN StreamDriver.TlsVerifyDepth SupportOctetCountedFraming WorkerThreads

imudp, [1] $IMUDPSchedulingPolicy $IMUDPSchedulingPriority $InputUDPServerBindRuleset $UDPServerAddress $UDPServerRun $UDPServerTimeRequery Address BatchSize DefaultTZ Device input parameters IpFreeBind module parameters Name Name.appendPort Port PreserveCase RateLimit.Burst RateLimit.Interval RcvBufSize Ruleset SchedulingPolicy SchedulingPriority Threads TimeRequery imuxsock $AddUnixListenSocket $IMUXSockRateLimitBurst $IMUXSockRateLimitInterval $IMUXSockRateLimitSeverity $InputUnixListenSocketAnnotate $InputUnixListenSocketCreatePath $InputUnixListenSocketFlowControl $InputUnixListenSocketHostName $InputUnixListenSocketIgnoreMsgTimestamp $InputUnixListenSocketUsePIDFromSystem $InputUnixListenSocketUseSysTimeStamp $OmitLocalLogging $ParseTrusted $SystemLogFlowControl $SystemLogParseTrusted $SystemLogRateLimitBurst $SystemLogRateLimitInterval $SystemLogRateLimitSeverity $SystemLogSocketAnnotate $SystemLogSocketIgnoreMsgTimestamp $SystemLogSocketName $SystemLogUsePIDFromSystem $SystemLogUseSysTimeStamp Annotate CreatePath FlowControl HostName IgnoreOwnMessages IgnoreTimestamp ParseHostname ParseTrusted RateLimit.Burst RateLimit.Interval RateLimit.Severity Ruleset Socket SysSock.Annotate SysSock.FlowControl SysSock.IgnoreOwnMessages SysSock.IgnoreTimestamp SysSock.Name SysSock.ParseHostname SysSock.ParseTrusted SysSock.RateLimit.Burst SysSock.RateLimit.Interval SysSock.RateLimit.Severity SysSock.Unlink SysSock.Use SysSock.UsePIDFromSystem SysSock.UseSpecialParser SysSock.UseSysTimeStamp Unlink UsePIDFromSystem UseSpecialParser UseSysTimeStamp indexTimeout input installation Docker ioBufferSize IpFreeBind

J

jsonRoot

K

KeepAlive, [1] KeepAlive.Interval, [1] KeepAlive.Probes, [1] KeepAlive.Time, [1]

KeepFailedMessages Key key killUnresponsive KubernetesURL

L

ListContainersOptions

ListenPortFileName, [1]

M

Main maxbytes MaxBytesPerMinute MaxFrameSize, [1] MaxLinesAtOnce MaxLinesPerMinute MaxListeners MaxSessions, [1] MaxSubmitAtOnce MessageOID mmaitag mmdarwin mmdblookup mmkubernetes allowunsignedcerts annotation_match busyretryinterval cacheentryttl cacheexpireinterval containerrulebase containerrules de_dot de_dot_separator dstmetadatapath filenamerulebase filenamerules KubernetesURL skipverifyhost srcmetadatapath sslpartialchain tls.cacert tls.mycert tls.myprivkey token tokenfile

mmnormalize $mmnormalizeRuleBase $mmnormalizeUseRawMsg allowRegex path rule ruleBase useRawMsg variable mmpstrucdata jsonRoot sd_name.lowercase mmrfc5424addhmac hashFunction key sdId mmsnmptrapd $mmsnmptrapdSeverityMapping $mmsnmptrapdTag severityMapping tag mmtaghostname forceLocalHostname tag Mode msgDiscardingError MultiLine

N

Name, [1], [2] Name.appendPort

needParse NotifyOnConnectionClose, [1] NotifyOnConnectionOpen, [1]

O

omczmq omelasticsearch allowunsignedcerts asyncrepl bulkid bulkmode dynbulkid dynParent dynPipelineName dynSearchIndex dynSearchType errorFile esVersion.major HealthCheckTimeout indexTimeout maxbytes parent pipelineName pwd ratelimit.burst ratelimit.interval rebindinterval retryfailures retryruleset searchIndex searchType Server Serverport skipPipelineIfEmpty skipverifyhost template timeout tls.cacert tls.mycert tls.myprivkey uid usehttps writeoperation omfile $ActionFileDefaultTemplate $ActionFileEnableSync $CreateDirs $DirCreateMode $DirGroup $DirGroupNum $DirOwner $DirOwnerNum $DynaFileCacheSize $FailOnCHOwnFailure $FileCreateMode $FileGroup $FileGroupNum $FileOwner $FileOwnerNum $OMFileASyncWriting $OMFileFlushInterval $OMFileFlushOnTXEnd $OMFileIOBufferSize $OMFileZipLevel $outchannel, [1] asyncWriting closeTimeout compression.driver compression.zstd.workers createDirs cry.Provider dirCreateMode dirGroup dirGroupNum dirOwner dirOwnerNum dynaFile dynafile.donotsuspend dynaFileCacheSize failOnChOwnFailure File fileCreateMode fileGroup fileGroupNum fileOwner fileOwnerNum flushInterval flushOnTXEnd ioBufferSize rotation.sizeLimit rotation.sizeLimitCommand sig.Provider sync Template veryRobustZip zipLevel

omkafka Broker closeTimeout ConfParam DynaKey DynaTopic DynaTopic.Cachesize errorFile failedMsgFile KeepFailedMessages Key Partitions.Auto Partitions.number Partitions.useFixed resubmitOnFailure statsFile statsName Template Topic TopicConfParam ompgsql omprog $ActionOMProgBinary beginTransactionMark binary closeTimeout commitTransactionMark confirmMessages confirmTimeout fileCreateMode forceSingleInstance hup.signal killUnresponsive output reportFailures signalOnClose template useTransactions omsendertrack omsnmp $actionsnmpcommunity $actionsnmpenterpriseoid $actionsnmpspecifictype $actionsnmpsyslogmessageoid $actionsnmptarget $actionsnmptargetport $actionsnmptransport $actionsnmptrapoid $actionsnmptraptype $actionsnmpversion Community EnterpriseOID MessageOID Port Server Snmpv1DynSource SpecificType Transport TrapOID TrapType Version Operational Rules Contribution Policy output

P

parent ParseHostname parser ParseTrusted Partitions.Auto Partitions.number Partitions.useFixed Path path permit.AtSignsInHostname permit.slashesInHostname permit.squareBracketsInHostname PermittedPeer persistStateAfterSubmission PersistStateInterval, [1] pipelineName pmrfc3164 detect.headerless detect.YearAfterTimestamp force.tagEndingByColon headerless.drop headerless.errorfile headerless.hostname headerless.ruleset headerless.tag permit.AtSignsInHostname permit.slashesInHostname permit.squareBracketsInHostname remove.msgFirstSpace

PollingInterval, [1] Port, [1], [2], [3] PreserveCase, [1] ProcessOnPoller pwd

Q

queues backpressure batching suspend/resume worker threads

R

RateLimit.Burst, [1], [2], [3] Ratelimit.Burst ratelimit.burst RateLimit.Interval, [1], [2], [3] Ratelimit.Interval ratelimit.interval RateLimit.Severity RcvBufSize readMode readTimeout rebindinterval Remote remove.msgFirstSpace removeStateOnDelete reopenOnTruncate reportFailures resubmitOnFailure RetrieveNewLogsFromStart retryfailures retryruleset reverse DNS cache reverse DNS refresh RFC RFC 3164, [1], [2] RFC 3195 RFC 5424, [1], [2], [3]

Roles Human-in-Control rotation.sizeLimit rotation.sizeLimitCommand rsyslog images Docker rsyslog/rsyslog containers Docker images rsyslog/rsyslog-collector containers Docker images rsyslog/rsyslog-dockerlogs containers Docker images rsyslog/rsyslog-minimal containers Docker images rule ruleBase Ruleset, [1], [2], [3], [4]

S

Safeguards SchedulingPolicy SchedulingPriority sd_name.lowercase sdId searchIndex searchType Server, [1] Serverport Severity severityMapping sig.Provider signalOnClose skipPipelineIfEmpty skipverifyhost, [1] Snmpv1DynSource Socket SocketBacklog, [1] sortFiles SpecificType srcmetadatapath sslpartialchain startmsg.regex StarvationProtection.MaxReads StateFile stateFile statefile.directory statsFile statsName

StreamDriver.AuthMode streamDriver.CAFile streamDriver.CertFile StreamDriver.checkExtendedKeyPurpose streamDriver.CRLFile streamDriver.KeyFile StreamDriver.Mode StreamDriver.Name StreamDriver.PermitExpiredCerts StreamDriver.PrioritizeSAN StreamDriver.TlsVerifyDepth SupportOctetCountedFraming, [1] sync SysSock.Annotate SysSock.FlowControl SysSock.IgnoreOwnMessages SysSock.IgnoreTimestamp SysSock.Name SysSock.ParseHostname SysSock.ParseTrusted SysSock.RateLimit.Burst SysSock.RateLimit.Interval SysSock.RateLimit.Severity SysSock.Unlink SysSock.Use SysSock.UsePIDFromSystem SysSock.UseSpecialParser SysSock.UseSysTimeStamp systemd environment variables

T

Tag tag, [1] Template, [1] template, [1] Threads, [1] timeout timeoutGranularity TimeRequery timezone tls.cacert, [1]

tls.mycert, [1] tls.myprivkey, [1] token tokenfile Topic TopicConfParam Transport TrapOID TrapType trimLineOverBytes

U

uid Unlink, [1] usehttps UsePid UsePIDFromSystem UsePidFromSystem

user images containers useRawMsg UseSpecialParser UseSysTimeStamp useTransactions

V

variable Version

veryRobustZip Visible Artifacts

W

WorkAroundJournalBug

WorkerThreads writeoperation

Z

zipLevel