Use this documentation with care! It describes the outdated version 7, which was actively developed around 2014 and is considered dead by the rsyslog team.

This documentation reflects the latest update of the v7-stable branch. It describes the 7.6.8 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v7 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is only limited rsyslog community support available for the outdated v7 version (officially we do not support it at all, but we usually are able to answer simple questions). If you need to stick with v7, it probably is best to ask your distribution for support.

im3195: RFC3195 Input Module

Receives syslog messages via RFC 3195. The RAW profile is fully implemented and the COOKED profile is provided in an experimental state. This module uses liblogging for the actual protocol handling.

Author:Rainer Gerhards <>

Configuration Directives

$Input3195ListenPort <port>

The port on which imklog listens for RFC 3195 messages. The default port is 601 (the IANA-assigned port)

Caveats/Known Bugs

Due to no demand at all for RFC3195, we have converted rfc3195d to this input module, but we have NOT conducted any testing. Also, the module does not yet properly handle the recovery case. If someone intends to put this module into production, good testing should be conducted. It also is a good idea to notify the rsyslog project that you intend to use it in production. In this case, we’ll probably give the module another cleanup. We don’t do this now because so far it looks just like a big waste of time.

Currently only a single listener can be defined. That one binds to all interfaces.


The following sample accepts syslog messages via RFC 3195 on port 1601.

$ModLoad im3195 $Input3195ListenPort 1601