diff options
| author | Rainer Gerhards <rgerhards@adiscon.com> | 2009-04-21 16:54:05 +0200 |
|---|---|---|
| committer | Rainer Gerhards <rgerhards@adiscon.com> | 2009-04-21 16:54:05 +0200 |
| commit | 88caccecf8dd8beaf46915df05241a44f7d635f6 (patch) | |
| tree | 7d6db5808b3bdd2453f041fef5c808b8fab36119 /doc/imtcp.html | |
| parent | 6e410a76f64d74fec03de27a6ca1f3f996844917 (diff) | |
| parent | 8e536c5b25ca1a7106f541149cf0d76bdf9237da (diff) | |
| download | rsyslog-88caccecf8dd8beaf46915df05241a44f7d635f6.tar.gz rsyslog-88caccecf8dd8beaf46915df05241a44f7d635f6.tar.xz rsyslog-88caccecf8dd8beaf46915df05241a44f7d635f6.zip | |
Merge branch 'master' into beta
Conflicts:
ChangeLog
configure.ac
doc/manual.html
Diffstat (limited to 'doc/imtcp.html')
| -rw-r--r-- | doc/imtcp.html | 29 |
1 files changed, 28 insertions, 1 deletions
diff --git a/doc/imtcp.html b/doc/imtcp.html index ecc72748..0ee0f96a 100644 --- a/doc/imtcp.html +++ b/doc/imtcp.html @@ -2,6 +2,8 @@ <html><head> <meta http-equiv="Content-Language" content="en"><title>TCP Syslog Input Module</title></head> <body> +<a href="rsyslog_conf_modules.html">back</a> + <h1>TCP Syslog Input Module</h1> <p><b>Module Name: imtcp</b></p> <p><b>Author: </b>Rainer Gerhards @@ -18,11 +20,36 @@ $InputTCPServerRun multiple times. This is not currently supported. </p> <p><b>Configuration Directives</b>:</p> <ul> +<li>$InputTCPServerAddtlFrameDelimiter <Delimiter><br> +This directive permits to specify an additional frame delimiter for plain tcp syslog. +The industry-standard specifies using the LF character as frame delimiter. Some vendors, +notable Juniper in their NetScreen products, use an invalid frame delimiter, in Juniper's +case the NUL character. This directive permits to specify the ASCII value of the delimiter +in question. Please note that this does not guarantee that all wrong implementations can +be cured with this directive. It is not even a sure fix with all versions of NetScreen, +as I suggest the NUL character is the effect of a (common) coding error and thus will +probably go away at some time in the future. But for the time being, the value 0 can +probably be used to make rsyslog handle NetScreen's invalid syslog/tcp framing. +For additional information, see this +<a href="http://kb.monitorware.com/problem-with-netscreen-log-t1652.html">forum thread</a>. +<br><b>If this doesn't work for you, please do not blame the rsyslog team. Instead file +a bug report with Juniper!</b> +<br>Note that a similar, but worse, issue exists with Cisco's IOS implementation. They do +not use any framing at all. This is confirmed from Cisco's side, but there seems to be +very limited interest in fixing this issue. This directive <b>can not</b> fix the Cisco bug. +That would require much more code changes, which I was unable to do so far. Full details +can be found at the <a href="http://www.rsyslog.com/Article321.phtml">Cisco tcp syslog anomaly</a> +page. <li>$InputTCPServerRun <port><br> Starts a TCP server on selected port</li> <li><ul><li>$InputTCPMaxSessions <number></li></ul> Sets the maximum number of sessions supported</li><li>$InputTCPServerStreamDriverMode <number><br> -Sets the driver mode for the currently selected <a href="netstream.html">network stream driver</a>. <number> is driver specifc.</li><li>$InputTCPServerStreamDriverAuthMode <mode-string><br> +Sets the driver mode for the currently selected <a href="netstream.html">network stream driver</a>. <number> is driver specifc.</li> +<li>$InputTCPServerInputName <name><br> +Sets a name for the inputname property. If no name is set "imtcp" is used by default. Setting a +name is not strictly necessary, but can be useful to apply filtering based on which input +the message was received from. +<li>$InputTCPServerStreamDriverAuthMode <mode-string><br> Sets the authentication mode for the currently selected <a href="netstream.html">network stream driver</a>. <mode-string> is driver specifc.</li><li>$InputTCPServerStreamDriverPermittedPeer <id-string><br> Sets permitted peer IDs. Only these peers are able to connect to the listener. <id-string> semantics depend on the currently selected |