diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/imrelp.html | 52 | ||||
| -rw-r--r-- | doc/omrelp.html | 54 | ||||
| -rw-r--r-- | doc/rsyslog_conf.html | 4 | ||||
| -rw-r--r-- | doc/rsyslog_ng_comparison.html | 178 |
4 files changed, 216 insertions, 72 deletions
diff --git a/doc/imrelp.html b/doc/imrelp.html new file mode 100644 index 00000000..b6f1f2bc --- /dev/null +++ b/doc/imrelp.html @@ -0,0 +1,52 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<html><head> +<meta http-equiv="Content-Language" content="en"><title>RELP Input Module</title> + +</head> +<body> +<h1>RELP Input Module</h1> +<p><b>Module Name: imrelp</b></p> +<p><b>Author: Rainer Gerhards</b></p> +<p><b>Description</b>:</p> +<p>Provides the ability to receive syslog messages via the +reliable RELP protocol. This module requires <a href="http://www.librelp.com">librelp</a> to be +present on the system. From the user's point of view, imrelp works much +like imtcp or imgssapi, except that no message loss can occur. Please +note that with the currently supported relp protocol version, a minor +message duplication may occur if a network connection between the relp +client and relp server breaks after the client could successfully send +some messages but the server could not acknowledge them. The window of +opportunity is very slim, but in theory this is possible. Future +versions of RELP will prevent this. Please also note that rsyslogd may +lose a few messages if rsyslog is shutdown while a network conneciton +to the server is broken and could not yet be recovered. Future version +of RELP support in rsyslog will prevent that. Please note that both +scenarios also exists with plain tcp syslog. RELP, even with the small +nits outlined above, is a much more reliable solution than plain tcp +syslog and so it is highly suggested to use RELP instead of plain tcp. +Clients send messages to the RELP server via omrelp.</p> +<p><b>Configuration Directives</b>:</p> +<ul> +<li>InputRELPServerRun <port><br> +Starts a RELP server on selected port</li> +</ul> +<b>Caveats/Known Bugs:</b> +<ul> +<li>see description</li> +</ul> +<p><b>Sample:</b></p> +<p>This sets up a RELP server on port 2514.<br> +</p> +<textarea rows="15" cols="60">$ModLoad imrelp # needs to be done just once +$InputRELPServerRun 2514 +</textarea> +<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] +[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> +<p><font size="2">This documentation is part of the +<a href="http://www.rsyslog.com/">rsyslog</a> +project.<br> +Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer +Gerhards</a> and +<a href="http://www.adiscon.com/">Adiscon</a>. +Released under the GNU GPL version 3 or higher.</font></p> +</body></html>
\ No newline at end of file diff --git a/doc/omrelp.html b/doc/omrelp.html new file mode 100644 index 00000000..0952cc71 --- /dev/null +++ b/doc/omrelp.html @@ -0,0 +1,54 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<html><head> +<meta http-equiv="Content-Language" content="en"><title>RELP Output Module (omrelp)</title> + +</head> +<body> +<h1>RELP Output Module (omlibdbi)</h1> +<p><b>Module Name: omrelp</b></p> +<p><b>Author: </b>Rainer Gerhards +<rgerhards@adiscon.com></p> +<p><b>Description</b>:</p> +<p>This module supports sending syslog messages over the reliable +RELP protocol. For RELP's advantages over plain tcp syslog, please see +the documentation for <a href="imrelp.html">imrelp</a> +(the server counterpart). </p> +<span style="font-weight: bold;">Setup</span> +<p>Please note the <a href="http://www.librelp.com">librelp</a> +is required for imrelp (it provides the core relp protocol +implementation).</p> +<p><b>Configuration Directives</b>:</p> +<p>This module uses old-style action configuration to keep +consistent with the forwarding rule. So far, no additional +configuration directives can be specified. To send a message via RELP, +use</p> +<p>*.* + :omrelp:<sever>:<port>;<template></p> +<p>just as you use </p> +<p>*.* + @@<sever>:<port>;<template></p> +<p>to forward a message via plain tcp syslog.</p> +<b>Caveats/Known Bugs:</b> +<p>See <a href="imrelp.html">imrelp</a>, +which documents them. </p> +<p><b>Sample:</b></p> +<p>The following sample sends all messages to the central server +"centralserv" at port 2514 (note that that server must run imrelp on +port 2514). Rsyslog's high-precision timestamp format is used, thus the +special "RSYSLOG_ForwardFormat" (case sensitive!) template is used.<br> +</p> +<textarea rows="15" cols="60">$ModLoad omrelp +# forward messages to the remote server "myserv" on +# port 2514 +*.* :omrelp:centralserv:2514;RSYSLOG_ForwardFormat +</textarea> +<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] +[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> +<p><font size="2">This documentation is part of the +<a href="http://www.rsyslog.com/">rsyslog</a> +project.<br> +Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer +Gerhards</a> and +<a href="http://www.adiscon.com/">Adiscon</a>. +Released under the GNU GPL version 3 or higher.</font></p> +</body></html>
\ No newline at end of file diff --git a/doc/rsyslog_conf.html b/doc/rsyslog_conf.html index 5931a241..2a0f0c60 100644 --- a/doc/rsyslog_conf.html +++ b/doc/rsyslog_conf.html @@ -26,7 +26,7 @@ number of modules. Here is the entry point to their documentation and what they do (list is currently not complete)</p> <ul> <li><a href="omsnmp.html">omsnmp</a> - SNMP -trap output module</li><li>omrelp - RELP output module</li> +trap output module</li><li><a href="omrelp.html">omrelp</a> - RELP output module</li> <li>omgss - output module for GSS-enabled syslog</li> <li>ommysql - output module for MySQL</li> <li>ompgsql - output module for PostgreSQL</li> @@ -34,7 +34,7 @@ trap output module</li><li>omrelp - RELP output module</li> generic database output module (Firebird/Interbase, MS SQL, Sybase, SQLLite, Ingres, Oracle, mSQL)</li> <li><a href="imfile.html">imfile</a> -- input module for text files</li><li>imrelp - RELP input module</li> +- input module for text files</li><li><a href="imrelp.html">imrelp</a> - RELP input module</li> <li>imudp - udp syslog message input</li> <li><a href="imtcp.html">imtcp</a> - input plugin for plain tcp syslog</li> diff --git a/doc/rsyslog_ng_comparison.html b/doc/rsyslog_ng_comparison.html index 547501af..2a1d15bd 100644 --- a/doc/rsyslog_ng_comparison.html +++ b/doc/rsyslog_ng_comparison.html @@ -1,6 +1,8 @@ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><head> -<meta content="de" http-equiv="Content-Language"><title>rsyslog vs. syslog-ng - a comparison</title></head> +<meta content="de" http-equiv="Content-Language"><title>rsyslog vs. syslog-ng - a comparison</title> + +</head> <body> <h1>rsyslog vs. syslog-ng</h1> <p><small><i>Written by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> @@ -25,56 +27,72 @@ comparison sheet, so please don't be shy ;)</p> <td valign="top"><b>rsyslog</b></td> <td valign="top"><b>syslog-ng</b></td> </tr> - - <tr> -<td colspan="3" valign="top"><br><b>Input Sources</b><br></td> +<td colspan="3" valign="top"><br> +<b>Input Sources</b><br> +</td> </tr> -<tr><td valign="top">UNIX domain socket</td> +<tr> +<td valign="top">UNIX domain socket</td> +<td valign="top">yes</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td></td> +</tr> <tr> <td valign="top">UDP</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">TCP</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> +<tr> +<td valign="top"><a href="http://www.librelp.com">RELP</a></td> +<td valign="top">yes</td> +<td valign="top">no</td> +<td></td> +</tr> <tr> <td valign="top">RFC 3195/BEEP</td> <td valign="top">yes (needs separate build process)</td> -<td valign="top">no</td><td> -</td></tr> +<td valign="top">no</td> +<td></td> +</tr> <tr> <td valign="top">kernel log</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">file</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> -<td valign="top">mark message generator as an optional input</td> +<td valign="top">mark message generator as an +optional input</td> <td valign="top">yes</td> -<td valign="top">no (?)</td><td> -</td></tr> +<td valign="top">no (?)</td> +<td></td> +</tr> <tr> <td valign="top">Windows Event Log</td> <td valign="top">via <a href="http://www.eventreporter.com">EventReporter</a> or <a href="http://www.mwagent.com">MonitorWare Agent</a> (both commercial software)</td> -<td valign="top">via separate Windows agent, paid edition only</td> +<td valign="top">via separate Windows agent, paid +edition only</td> </tr> - - <tr> -<td colspan="3" valign="top"><b><br>Network (Protocol) Support</b><br></td> +<td colspan="3" valign="top"><b><br> +Network (Protocol) Support</b><br> +</td> </tr> <tr> <td valign="top">support for (plain) tcp based syslog</td> @@ -104,6 +122,11 @@ based framing on syslog/tcp connections</td> <td valign="top">yes</td> </tr> <tr> +<td valign="top">syslog over RELP<br>this is a truely reliable solution (plain tcp syslog can lose messages!)</td> +<td valign="top">yes</td> +<td valign="top">no</td> +</tr> +<tr> <td valign="top">on the wire (zlib) message compression</td> <td valign="top">yes</td> @@ -146,38 +169,46 @@ hostname in NAT environments and relay chains</td> <td valign="top">yes</td> <td valign="top">yes</td> </tr> - - <tr> -<td colspan="3" valign="top"><br><b>Message Filtering</b><br></td> +<td colspan="3" valign="top"><br> +<b>Message Filtering</b><br> +</td> </tr> -<tr><td valign="top">Filtering for syslog facility and priority</td> +<tr> +<td valign="top">Filtering for syslog facility and +priority</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">Filtering for hostname</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">Filtering for application</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">Filtering for message contents</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">Filtering for sending IP address</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> -<td valign="top">ability to filter on any other message -field not mentioned above +<td valign="top">ability to filter on any other +message +field not mentioned above (including substrings and the like)</td> <td valign="top">yes</td> <td valign="top">no</td> @@ -210,8 +241,9 @@ in filters</td> <td valign="top">support for discarding messages based on filters</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">powerful BSD-style hostname and program name blocks for easy multi-host support</td> @@ -223,10 +255,10 @@ program name blocks for easy multi-host support</td> <td></td> <td></td> </tr> - - <tr> -<td colspan="3" valign="top"><br><b>Supported Database Outputs</b><br></td> +<td colspan="3" valign="top"><br> +<b>Supported Database Outputs</b><br> +</td> </tr> <tr> <td valign="top">MySQL</td> @@ -274,10 +306,10 @@ program name blocks for easy multi-host support</td> <td valign="top">yes (<a href="omlibdbi.html">omlibdbi</a>)</td> <td valign="top">no (?)</td> </tr> - - <tr> -<td colspan="3" valign="top"><br><b>Enterprise Features</b><br></td> +<td colspan="3" valign="top"><br> +<b>Enterprise Features</b><br> +</td> </tr> <tr> <td valign="top">support for on-demand on-disk @@ -292,7 +324,8 @@ by spool files</td> <td valign="top">yes</td> </tr> <tr> -<td valign="top">each action can use its own, independant +<td valign="top">each action can use its own, +independant set of spool files</td> <td valign="top">yes</td> <td valign="top">no</td> @@ -314,10 +347,10 @@ syslog/database servers </td> <td><a href="professional_support.html">yes</a></td> <td>yes</td> </tr> - - <tr> -<td colspan="3" valign="top"><br><b>Config File</b><br></td> +<td colspan="3" valign="top"><br> +<b>Config File</b><br> +</td> </tr> <tr> <td valign="top">config file format</td> @@ -338,37 +371,40 @@ existing in a specific directory</td> <td height="25" valign="top">yes</td> <td height="25" valign="top">no</td> </tr> - - - <tr> -<td colspan="3" valign="top"><br><b>Extensibility</b><br></td> +<td colspan="3" valign="top"><br> +<b>Extensibility</b><br> +</td> </tr> <tr> -<td valign="top">Functionality split in separately loadable +<td valign="top">Functionality split in separately +loadable modules</td> <td valign="top">yes</td> <td valign="top">no</td> </tr> <tr> -<td valign="top">Support for third-party input plugins</td> +<td valign="top">Support for third-party input +plugins</td> <td valign="top">yes</td> <td valign="top">no</td> </tr> <tr> </tr> -<tr><td valign="top">Support for third-party output plugins</td> +<tr> +<td valign="top">Support for third-party output +plugins</td> <td valign="top">yes</td> <td valign="top">no</td> </tr> - - - <tr> -<td colspan="3" valign="top"><br><b>Other Features</b><br></td> +<td colspan="3" valign="top"><br> +<b>Other Features</b><br> +</td> +</tr> +<tr> </tr> <tr> -</tr><tr> <td valign="top">ability to generate file names and directories (log targets) dynamically</td> <td valign="top">yes</td> @@ -440,8 +476,9 @@ reduction ("last message repeated n times") on a per selector-line basis</td> <td valign="top">supports multiple actions per selector/filter condition</td> <td valign="top">yes</td> -<td valign="top">yes</td><td> -</td></tr> +<td valign="top">yes</td> +<td></td> +</tr> <tr> <td valign="top">web interface</td> <td valign="top"><a href="http://www.phplogcon.org">phpLogCon</a><br> @@ -469,8 +506,11 @@ system stress</td> <tr> <td height="43" valign="top">flow control (slow down message reception when system is busy)</td> -<td height="43" valign="top">yes (advanced, with multiple ways to slow down inputs depending on individual input capabilities, based on watermarks)</td> -<td height="43" valign="top">yes (limited? "stops accepting messages")</td> +<td height="43" valign="top">yes (advanced, +with multiple ways to slow down inputs depending on individual input +capabilities, based on watermarks)</td> +<td height="43" valign="top">yes (limited? +"stops accepting messages")</td> </tr> <tr> <td valign="top">rewriting messages</td> @@ -504,8 +544,6 @@ Solaris; compilation and basic testing done on HP UX</td> <td valign="top">no</td> <td valign="top">yes</td> </tr> - - </tbody> </table> <p>While the <span style="font-weight: bold;">rsyslog</span> |