From e7d4ec890b42ceb0ab9bb4ee5ecc9a9e489c7388 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 11 Aug 2010 14:38:21 +0200 Subject: imptcp: added $InputPTCPServerNotifyOnConnectionClose directive plus some minor cleanup --- doc/imptcp.html | 3 --- 1 file changed, 3 deletions(-) (limited to 'doc') diff --git a/doc/imptcp.html b/doc/imptcp.html index 913563a5..c63ddc34 100644 --- a/doc/imptcp.html +++ b/doc/imptcp.html @@ -45,10 +45,7 @@ That would require much more code changes, which I was unable to do so far. Full can be found at the Cisco tcp syslog anomaly page.
  • $InputPTCPServerNotifyOnConnectionClose [on/off]
    -CURRENTLY DISABLED
    instructs imptcp to emit a message if the remote peer closes a connection.
    -Important: This directive is global to all listeners and must be given right -after loading imptcp, otherwise it may have no effect.
  • $InputPTCPServerRun <port>
    Starts a TCP server on selected port
  • $InputPTCPServerInputName <name>
    -- cgit From 809ed1768b83bc0c5392f943f4820523494e8285 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 11 Aug 2010 15:06:50 +0200 Subject: imptcp: added $InputPTCPServerAddtlFrameDelimiter directive also improved testbench --- doc/imptcp.html | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'doc') diff --git a/doc/imptcp.html b/doc/imptcp.html index c63ddc34..d4228185 100644 --- a/doc/imptcp.html +++ b/doc/imptcp.html @@ -7,7 +7,7 @@

    Plain TCP Syslog Input Module

    Module Name:    imptcp

    -

    Available since: 4.7.3+, 5.5.8+? +

    Available since: 4.7.3+, 5.5.8+

    Author: Rainer Gerhards <rgerhards@adiscon.com>

    Description:

    @@ -24,7 +24,6 @@ specifying $InputPTCPServerRun multiple times. their name instead of just TCP. Note that only a subset of the parameters are supported.
    • $InputPTCPServerAddtlFrameDelimiter <Delimiter>
      -CURRENTLY DISABLED
      This directive permits to specify an additional frame delimiter for plain tcp syslog. The industry-standard specifies using the LF character as frame delimiter. Some vendors, notable Juniper in their NetScreen products, use an invalid frame delimiter, in Juniper's -- cgit