The rocket-fast system for log processing

im3195: RFC3195 Input Module

Module Name: im3195
Author: Rainer Gerhards <>


Receives syslog messages via RFC 3195. The RAW profile is fully implemented and the COOKED profile is provided in an experimental state. This module uses liblogging for the actual protocol handling.

Configuration Parameters


Parameter names are case-insensitive.

Input Parameter



Parameter is only available in Legacy Format.

type default mandatory obsolete legacy directive
integer 601 no $Input3195ListenPort

The port on which imklog listens for RFC 3195 messages. The default port is 601 (the IANA-assigned port)

Caveats/Known Bugs

Due to no demand at all for RFC3195, we have converted rfc3195d to this input module, but we have NOT conducted any testing. Also, the module does not yet properly handle the recovery case. If someone intends to put this module into production, good testing should be conducted. It also is a good idea to notify the rsyslog project that you intend to use it in production. In this case, we’ll probably give the module another cleanup. We don’t do this now because so far it looks just like a big waste of time.

Currently only a single listener can be defined. That one binds to all interfaces.


The following sample accepts syslog messages via RFC 3195 on port 1601.

$ModLoad im3195
$Input3195ListenPort 1601

See also

If you would like to contribute to these docs, but are unsure where to start, please see the rsyslog-doc project README for an overview of the process. If you would like to contribute to the main source project, please review the contribution guidelines listed in the rsyslog project README.

If you have a question about these docs or Rsyslog in general, please see the following resources:

© 2008-2017, Rainer Gerhards and Others. This site uses the “better” theme for Sphinx.