1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head>
<meta http-equiv="Content-Language" content="en">
<title>Plain TCP Syslog Input Module (imptcp)</title></head>
<body>
<a href="rsyslog_conf_modules.html">back</a>
<h1>Plain TCP Syslog Input Module</h1>
<p><b>Module Name: imptcp</b></p>
<p><b>Available since: </b>4.7.3+, 5.5.8+
<p><b>Author: </b>Rainer Gerhards
<rgerhards@adiscon.com></p>
<p><b>Description</b>:</p>
<p>Provides the ability to receive syslog messages via plain TCP syslog.
This is a specialised input plugin tailored for high performance on Linux. It will
probably not run on any other platform. Also, it does not provide TLS services.
Encryption can be provided by using <a href="rsyslog_stunnel.html">stunnel</a>.
<p>This module has no limit on the number of listeners and sessions that can be used.
</p>
<p><b>Configuration Directives</b>:</p>
<p>This plugin has config directives similar named as imtcp, but they all have <b>P</b>TCP in
their name instead of just TCP. Note that only a subset of the parameters are supported.
<ul>
<p><b>Module Parameters</b>:</p>
<p>These paramters can be used with the "module()" statement. They apply
globaly to all inputs defined by the module.
<ul>
<li>Threads <number><br>
Number of helper worker threads to process incoming messages. These
threads are utilized to pull data off the network. On a busy system, additional
helper threads (but not more than there are CPUs/Cores) can help improving
performance. The default value is two, which means there
is a default thread count of three (the main input thread plus two
helpers).
No more than 16 threads can be set (if tried to, rsyslog always resorts to 16).
</ul>
<p><b>Input Parameters</b>:</p>
<p>These parameters can be used with the "input()" statement. They apply to the
input they are specified with.
<ul>
<li><b>AddtlFrameDelimiter</b> <Delimiter><br>
This directive permits to specify an additional frame delimiter for plain tcp syslog.
The industry-standard specifies using the LF character as frame delimiter. Some vendors,
notable Juniper in their NetScreen products, use an invalid frame delimiter, in Juniper's
case the NUL character. This directive permits to specify the ASCII value of the delimiter
in question. Please note that this does not guarantee that all wrong implementations can
be cured with this directive. It is not even a sure fix with all versions of NetScreen,
as I suggest the NUL character is the effect of a (common) coding error and thus will
probably go away at some time in the future. But for the time being, the value 0 can
probably be used to make rsyslog handle NetScreen's invalid syslog/tcp framing.
For additional information, see this
<a href="http://kb.monitorware.com/problem-with-netscreen-log-t1652.html">forum thread</a>.
<br><b>If this doesn't work for you, please do not blame the rsyslog team. Instead file
a bug report with Juniper!</b>
<br>Note that a similar, but worse, issue exists with Cisco's IOS implementation. They do
not use any framing at all. This is confirmed from Cisco's side, but there seems to be
very limited interest in fixing this issue. This directive <b>can not</b> fix the Cisco bug.
That would require much more code changes, which I was unable to do so far. Full details
can be found at the <a href="http://www.rsyslog.com/Article321.phtml">Cisco tcp syslog anomaly</a>
page.
<li><b>SupportOctetCountedFraming</b> <<b>on</b>|off><br>
If set to "on", the legacy octed-counted framing (similar to RFC5425 framing) is
activated. This is the default and should be left unchanged until you know
very well what you do. It may be useful to turn it off, if you know this framing
is not used and some senders emit multi-line messages into the message stream.
</li>
<li><b>ServerNotifyOnConnectionClose</b> [on/<b>off</b>]<br>
instructs imptcp to emit a message if the remote peer closes a connection.<br>
<li><b>KeepAlive</b> <on/<b>off</b>><br>
enable of disable keep-alive packets at the tcp socket layer. The default is
to disable them.</li>
<li><b>KeepAlive.Probes</b> <number><br>
The number of unacknowledged probes to send before considering the connection dead and notifying the application layer.
The default, 0, means that the operating system defaults are used. This has only
effect if keep-alive is enabled. The functionality may not be available on
all platforms.
<li><b>KeepAlive.Interval</b> <number><br>
The interval between subsequent keepalive probes, regardless of what the connection has exchanged in the meantime.
The default, 0, means that the operating system defaults are used. This has only
effect if keep-alive is enabled. The functionality may not be available on
all platforms.
<li><b>KeepAlive.Time</b> <number><br>
The interval between the last data packet sent (simple ACKs are not considered data) and the first keepalive probe; after the connection is marked to need keepalive, this counter is not used any further.
The default, 0, means that the operating system defaults are used. This has only
effect if keep-alive is enabled. The functionality may not be available on
all platforms.
<li><b>Port</b> <number><br>
Select a port to listen on</li>
<li><b>Name</b> <name><br>
Sets a name for the inputname property. If no name is set "imptcp" is used by default. Setting a
name is not strictly necessary, but can be useful to apply filtering based on which input
the message was received from.
<li><b>Ruleset</b> <name><br>
Binds specified ruleset to next server defined.
<li><b>Address</b> <name><br>
On multi-homed machines, specifies to which local address the listerner should be bound.
<li><b>defaultTZ</b> <timezone-info><br>
This is an <b>experimental</b> parameter; details may change at any time and it may
also be discoutinued without any early warning.<br>
Permits to set a default timezone for this listener. This is useful when working with
legacy syslog (RFC3164 et al) residing in different timezones. If set it will be used as
timezone for all messages <b>that do not contain timezone info</b>.
Currently, the format <b>must</b> be "+/-hh:mm", e.g. "-05:00", "+01:30". Other formats,
including TZ names (like EST) are NOT yet supported. Note that consequently no daylight
saving settings are evaluated when working with timezones. If an invalid format is used,
"interesting" things can happen, among them malformed timestamps and rsyslogd segfaults.
This will obviously be changed at the time this feature becomes non-experimental.</li>
<li><b>RateLimit.Interval</b> [number] - (available since 7.3.1) specifies the rate-limiting
interval in seconds. Default value is 0, which turns off rate limiting. Set it to a number
of seconds (5 recommended) to activate rate-limiting.
</li>
<li><b>RateLimit.Burst</b> [number] - (available since 7.3.1) specifies the rate-limiting
burst in number of messages. Default is 10,000.
<li><b>compression.mode</b><i>mode</i><br>
<i>mode</i> is one of "none" or "stream:always".
It is the counterpart to the compression modes set in
<a href="omfile.html">omfile</a>.
Please see it's documentation for details.
</li>
</ul>
<b>Caveats/Known Bugs:</b>
<ul>
<li>module always binds to all interfaces</li>
</ul>
<p><b>Sample:</b></p>
<p>This sets up a TCP server on port 514:<br>
</p>
<textarea rows="4" cols="60">module(load="/folder/to/rsyslog/plugins/imptcp/.libs/imptcp") # needs to be done just once
input(type="imptcp" port="514")
</textarea>
<p><b>Legacy Configuration Directives</b>:</p>
<ul>
<li>$InputPTCPServerAddtlFrameDelimiter <Delimiter><br>
Equivalent to: AddTLFrameDelimiter</li>
<li><b>$InputPTCPSupportOctetCountedFraming</b> <<b>on</b>|off><br>
Equivalent to: SupportOctetCountedFraming
</li>
<li>$InputPTCPServerNotifyOnConnectionClose [on/<b>off</b>]<br>
Equivalent to: ServerNotifyOnConnectionClose.<br></li>
<li><b>$InputPTCPServerKeepAlive</b> <on/<b>off</b>><br>
Equivalent to: KeepAlive </li>
<li><b>$InputPTCPServerKeepAlive_probes</b> <number><br>
Equivalent to: KeepAlive.Probes</li>
<li><b>$InputPTCPServerKeepAlive_intvl</b> <number><br>
Equivalent to: KeepAlive.Interval </li>
<li><b>$InputPTCPServerKeepAlive_time</b> <number><br>
Equivalent to: KeepAlive.Time</li>
<li><b>$InputPTCPServerRun</b> <port><br>
Equivalent to: Port </li>
<li>$InputPTCPServerInputName <name><br>
Equivalent to: Name </li>
<li>$InputPTCPServerBindRuleset <name><br>
Equivalent to: Ruleset </li>
<li>$InputPTCPServerHelperThreads <number><br>
Equivalent to: threads </li>
<li>$InputPTCPServerListenIP <name><br>
Equivalent to: Address </li>
</ul>
<b>Caveats/Known Bugs:</b>
<ul>
<li>module always binds to all interfaces</li>
</ul>
<p><b>Sample:</b></p>
<p>This sets up a TCP server on port 514:<br>
</p>
<textarea rows="3" cols="60">$ModLoad imptcp #
needs to be done just once
$InputPTCPServerRun 514
</textarea>
<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>]
[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
<p><font size="2">This documentation is part of the
<a href="http://www.rsyslog.com/">rsyslog</a>
project.<br>
Copyright © 2010-2013 by <a href="http://www.gerhards.net/rainer">Rainer
Gerhards</a> and
<a href="http://www.adiscon.com/">Adiscon</a>.
Released under the GNU GPL version 3 or higher.</font></p>
</body></html>
|
