From 9900fbe2e85f39b999f50d2ba4463d507f731f4c Mon Sep 17 00:00:00 2001 From: Florian Riedl Date: Tue, 24 Jul 2012 12:54:56 +0200 Subject: doc: improved doc for built-in modules --- doc/Makefile.am | 4 + doc/omfile.html | 167 ++++++++++++++++++++++++++++++++++++++++++ doc/omfwd.html | 118 +++++++++++++++++++++++++++++ doc/ompipe.html | 62 ++++++++++++++++ doc/omusrmsg.html | 64 ++++++++++++++++ doc/rsyslog_conf_global.html | 48 ++++++------ doc/rsyslog_conf_modules.html | 4 + 7 files changed, 443 insertions(+), 24 deletions(-) create mode 100644 doc/omfile.html create mode 100644 doc/omfwd.html create mode 100644 doc/ompipe.html create mode 100644 doc/omusrmsg.html (limited to 'doc') diff --git a/doc/Makefile.am b/doc/Makefile.am index 04fda6b3..cc1a3209 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -31,6 +31,10 @@ html_files = \ version_naming.html \ contributors.html \ dev_queue.html \ + ompipe.html \ + omfwd.html \ + omfile.html \ + omusrmsg.html \ omstdout.html \ omudpspoof.html \ omruleset.html \ diff --git a/doc/omfile.html b/doc/omfile.html new file mode 100644 index 00000000..bdd1ebc6 --- /dev/null +++ b/doc/omfile.html @@ -0,0 +1,167 @@ + + + +File Output Module + + +back + +

File Output Module

Module Name: omfile

Author: Rainer Gerhards <rgergards@adiscon.com>

Description:

The omfile plug-in provides the core functionality of writing messages to files residing inside the local file system (which may actually be remote if methods like NFS are used). Both files named with static names as well files with names based on message content are supported by this module. It is a built-in module that does not need to be loaded.

+ +

Global Configuration Directives:

Template [templateName]
+ sets a new default template for file actions.

Action specific Configuration Directives:

DynaFileCacheSize (not mandatory, default will be used)
+ Defines a template to be used for the output.

ZipLevel 0..9 [default 0]
+ if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.

FlushInterval (not mandatory, default will be used)
+ Defines a template to be used for the output.

ASyncWriting on/off [default off]
+ if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable FlushInterval, AsyncWriting must be set to "on". Otherwise, the flush interval will be ignored. Also note that when FlushOnTXEnd is "on" but AsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal.

FlushOnTXEnd on/off [default on]
+ Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where this is unacceptable, set FlushOnTXEnd to on. Then, data is written at the end of each transaction (for pre-v5 this means after each log message) and the usual error recovery thus can handle write errors without data loss. Note that this option severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour.

IOBufferSize <size_nbr>, default 4k
+ size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)

DirOwner
+ Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

DirGroup
+ Set the group for directories newly created. Please note that this setting does not affect the group of directories already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on during startup processing. Interim changes to the user mapping are not detected.

FileOwner
+ Set the file owner for dynaFiles newly created. Please note that this setting does not affect the owner of files already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

FileGroup
+ Set the group for dynaFiles newly created. Please note that this setting does not affect the group of files already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

DirCreateMode [defaul 0700]
+ This is the same as $FileCreateMode, but for directories automatically generated.

FileCreateMode [default 0644]
+ The FileCreateMode directive allows to specify the creation mode with which rsyslogd creates new files. If not specified, the value 0644 is used (which retains backward-compatibility with earlier releases). The value given must always be a 4-digit octal number, with the initial digit being zero.
Please note that the actual permission depend on rsyslogd's process umask. If in doubt, use "$umask 0000" right at the beginning of the configuration file to remove any restrictions.
FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important.

FailOnCHOwnFailure on/off [default on]
+ This option modifies behaviour of dynaFile creation. If different owners or groups are specified for new files or directories and rsyslogd fails to set these new owners or groups, it will log an error and NOT write to the file in question if that option is set to "on". If it is set to "off", the error will be ignored and processing continues. Keep in mind, that the files in this case may be (in)accessible by people who should not have permission. The default is "on".

CreateDirs on/off [default on]
+ create directories on an as-needed basis

Sync on/off [default off]
+ enables file syncing capability of omfile.

File
+ If the file already exists, new data is appended to it. Existing data is not truncated. If the file does not already exist, it is created. Files are kept open as long as rsyslogd is active. This conflicts with external log file rotation. In order to close a file after rotation, send rsyslogd a HUP signal after the file has been rotated away.

DynaFile
+ For each message, the file name is generated based on the given template. Then, this file is opened. As with the ``file'' property, data is appended if the file already exists. If the file does not exist, a new file is created. A cache of recent files is kept. Note that this cache can consume quite some memory (especially if large buffer sizes are used). Files are kept open as long as they stay inside the cache. Currently, files are only evicted from the cache when there is need to do so (due to insufficient cache size). To force-close (and evict) a dynafile from cache, send a HUP signal to rsyslogd.

Template [templateName]
+ sets a new default template for file actions.

Caveats/Known Bugs:

None.

Sample:

The following command writes all syslog messages into a file.

+ + +

+ +

Legacy Configuration Directives:

$DynaFileCacheSize (not mandatory, default will be used)
+ Defines a template to be used for the output.

$OMFileZipLevel 0..9 [default 0]
+ if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.

$OMFileFlushInterval (not mandatory, default will be used)
+ Defines a template to be used for the output.

$OMFileASyncWriting on/off [default off]
+ if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable FlushInterval, AsyncWriting must be set to "on". Otherwise, the flush interval will be ignored. Also note that when FlushOnTXEnd is "on" but AsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal.

$OMFileFlushOnTXEnd on/off [default on]
+ Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where this is unacceptable, set FlushOnTXEnd to on. Then, data is written at the end of each transaction (for pre-v5 this means after each log message) and the usual error recovery thus can handle write errors without data loss. Note that this option severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour.

$OMFileIOBufferSize <size_nbr>, default 4k
+ size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)

$DirOwner
+ Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

$DirGroup
+ Set the group for directories newly created. Please note that this setting does not affect the group of directories already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on during startup processing. Interim changes to the user mapping are not detected.

$FileOwner
+ Set the file owner for dynaFiles newly created. Please note that this setting does not affect the owner of files already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

$FileGroup
+ Set the group for dynaFiles newly created. Please note that this setting does not affect the group of files already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

$DirCreateMode [defaul 0700]
+ This is the same as $FileCreateMode, but for directories automatically generated.

$FileCreateMode [default 0644]
+ The FileCreateMode directive allows to specify the creation mode with which rsyslogd creates new files. If not specified, the value 0644 is used (which retains backward-compatibility with earlier releases). The value given must always be a 4-digit octal number, with the initial digit being zero.
Please note that the actual permission depend on rsyslogd's process umask. If in doubt, use "$umask 0000" right at the beginning of the configuration file to remove any restrictions.
FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important.

$FailOnCHOwnFailure on/off [default on]
+ This option modifies behaviour of dynaFile creation. If different owners or groups are specified for new files or directories and rsyslogd fails to set these new owners or groups, it will log an error and NOT write to the file in question if that option is set to "on". If it is set to "off", the error will be ignored and processing continues. Keep in mind, that the files in this case may be (in)accessible by people who should not have permission. The default is "on".

$F$OMFileForceCHOwn
+ force ownership change for all files

$CreateDirs on/off [default on]
+ create directories on an as-needed basis

$ActionFileEnableSync on/off [default off]
+ enables file syncing capability of omfile.

$ActionFileDefaultTemplate [templateName]
+ sets a new default template for file actions.

$ResetConfigVariables
+ Resets all configuration variables to their default value. Any settings made will not be applied to configuration lines following the $ResetConfigVariables. This is a good method to make sure no side-effects exists from previous directives. This directive has no parameters.

+ +

Legacy Sample:

The following command writes all syslog messages into a file.

+ + + +

[rsyslog.conf overview] [manual +index] [rsyslog site]

This documentation is part of the +rsyslog project.
+Copyright © 2008 by Rainer Gerhards and +Adiscon. Released under the GNU GPL +version 3 or higher.

+ + diff --git a/doc/omfwd.html b/doc/omfwd.html new file mode 100644 index 00000000..5599ae39 --- /dev/null +++ b/doc/omfwd.html @@ -0,0 +1,118 @@ + + + +Forwarding Output Module + + +back + +

Forwarding Output Module

Module Name: omfwd

Author: Rainer Gerhards <rgergards@adiscon.com>

Description:

The omfwd plug-in provides the core functionality of traditional message forwarding via UDP and plain TCP. It is a built-in module that does not need to be loaded.

+ +

Global Configuration Directives:

Template [templateName]
+ sets a new default template for file actions.

Action specific Configuration Directives:

Target string
+ Name or IP-Address of the system that shall receive messages. Any resolvable name is fine.

Port [Default 514]
+ Name or numerical value of port to use when connecting to target.

Protocol udp/tcp [default udp]
+ Type of protocol to use for forwarding. Note that ``tcp'' means both legacy plain tcp syslog as well as RFC5425-based TCL-encrypted syslog. Which one is selected depends on the protocol drivers set before the action commend. Note that as of 6.3.6, there is no way to specify this within the action itself.

TCP_Framing ``traditional'' or ``octet-counted'' [default traditional]
+ Framing-Mode to be for forwarding. This affects only TCP-based protocols. It is ignored for UDP. In protocol engineering, ``framing'' means how multiple messages over the same connection are separated. Usually, this is transparent to users. Unfortunately, the early syslog protocol evolved, and so there are cases where users need to specify the framing. The traditional framing is nontransparent. With it, messages are end when a LF (aka ``line break'', ``return'') is encountered, and the next message starts immediately after the LF. If multi-line messages are received, these are essentially broken up into multiple message, usually with all but the first message segment being incorrectly formatted. The octet-counting framing solves this issue. With it, each message is prefixed with the actual message length, so that a receivers knows exactly where the message ends. Multi-line messages cause no problem here. This mode is very close to the method described in RFC5425 for TLS-enabled syslog. Unfortunately, only few syslogd implementations support octet-counted framing. As such, the traditional framing is set as default, even though it has defects. If it is known that the receiver supports octet-counted framing, it is suggested to use that framing mode.

ZipLevel 0..9 [default 0]
+ Compression level for messages. Rsyslog implements a proprietary capability to zip transmitted messages. Note that compression happens on a message-per-message basis. As such, there is a performance gain only for larger messages. Before compressing a message, rsyslog checks if there is some gain by compression. If so, the message is sent compressed. If not, it is sent uncompressed. As such, it is totally valid that compressed and uncompressed messages are intermixed within a conversation.
The compression level is specified via the usual factor of 0 to 9, with 9 being the strongest compression (taking up most processing time) and 0 being no compression at all (taking up no extra processing time).

RebindInterval integer
+ Permits to specify an interval at which the current connection is broken and re-established. This setting is primarily an aid to load balancers. After the configured number of messages has been transmitted, the current connection is terminated and a new one started. Note that this setting applies to both TCP and UDP traffic. For UDP, the new ``connection'' uses a different source port (ports are cycled and not reused too frequently). This usually is perceived as a ``new connection'' by load balancers, which in turn forward messages to another physical target system.

StreamDriver string
+ Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.

StreamDriverMode integer [default 0]
+ mode to use with the stream driver (driver-specific)

StreamDriverAuthMode string
+ authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific).

StreamDriverPermittedPeers string
+ accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)

ResendLastMSGOnReconnect on/off
+ Permits to resend the last message when a connection is reconnected. This setting affects TCP-based syslog, only. It is most useful for traditional, plain TCP syslog. Using this protocol, it is not always possible to know which messages were successfully transmitted to the receiver when a connection breaks. In many cases, the last message sent is lost. By switching this setting to "yes", rsyslog will always retransmit the last message when a connection is reestablished. This reduces potential message loss, but comes at the price that some messages may be duplicated (what usually is more acceptable).

Caveats/Known Bugs:

None.

Sample:

The following command sends all syslog messages to a remote server via TCP port 10514.

+ + +

+ +

Legacy Configuration Directives:

$ActionForwardDefaultTemplateName string [templatename]
+ sets a new default template for UDP and plain TCP forwarding action

$ActionSendTCPRebindInterval integer
+ instructs the TCP send action to close and re-open the connection to the remote host every nbr of messages sent. Zero, the default, means that no such processing is done. This directive is useful for use with load-balancers. Note that there is some performance overhead associated with it, so it is advisable to not too often "rebind" the connection (what "too often" actually means depends on your configuration, a rule of thumb is that it should be not be much more often than once per second).

$ActionSendUDPRebindInterval integer
+ instructs the UDP send action to rebind the send socket every nbr of messages sent. Zero, the default, means that no rebind is done. This directive is useful for use with load-balancers.

$ActionSendStreamDriver <driver basename>
+ just like $DefaultNetstreamDriver, but for the specific action

$ActionSendStreamDriverMode <mode> [default 0]
+ mode to use with the stream driver (driver-specific)

$ActionSendStreamDriverAuthMode <mode>
+ authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific))

$ActionSendStreamDriverPermittedPeers <ID>
+ accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)

$ActionSendResendLastMsgOnReconnect on/off [default off]
+ specifies if the last message is to be resend when a connecition breaks and has been reconnected. May increase reliability, but comes at the risk of message duplication.

$ResetConfigVariables
+ Resets all configuration variables to their default value. Any settings made will not be applied to configuration lines following the $ResetConfigVariables. This is a good method to make sure no side-effects exists from previous directives. This directive has no parameters.

+ +

Legacy Sample:

The following command sends all syslog messages to a remote server via TCP port 10514.

+ + + +

[rsyslog.conf overview] [manual +index] [rsyslog site]

This documentation is part of the +rsyslog project.
+Copyright © 2008 by Rainer Gerhards and +Adiscon. Released under the GNU GPL +version 3 or higher.

+ + diff --git a/doc/ompipe.html b/doc/ompipe.html new file mode 100644 index 00000000..49915b78 --- /dev/null +++ b/doc/ompipe.html @@ -0,0 +1,62 @@ + + + +Pipe Output Module + + +back + +

Pipe Output Module

Module Name: omfwd

Author: Rainer Gerhards <rgergards@adiscon.com>

Description:

The ompipe plug-in provides the core functionality for logging output to named pipes (fifos). It is a built-in module that does not need to be loaded.

+ +

Global Configuration Directives:

Template [templateName]
+ sets a new default template for file actions.

Action specific Configuration Directives:

Pipe string
+ A fifo or named pipe can be used as a destination for log messages.

Caveats/Known Bugs:

None.

Sample:

The following command sends all syslog messages to a remote server via TCP port 10514.

+ + +

+ +

Legacy Configuration Directives:

rsyslog has support for logging output to named pipes (fifos). A fifo or named pipe can be used as a destination for log messages by prepending a pipe symbol ("|'') to the name of the file. This is handy for debugging. Note that the fifo must be created with the mkfifo(1) command before rsyslogd is started. + +

+ +

Legacy Sample:

The following command sends all syslog messages to a remote server via TCP port 10514.

+ + + +

[rsyslog.conf overview] [manual +index] [rsyslog site]

This documentation is part of the +rsyslog project.
+Copyright © 2008 by Rainer Gerhards and +Adiscon. Released under the GNU GPL +version 3 or higher.

+ + diff --git a/doc/omusrmsg.html b/doc/omusrmsg.html new file mode 100644 index 00000000..eccfef2d --- /dev/null +++ b/doc/omusrmsg.html @@ -0,0 +1,64 @@ + + + +User Message Output Module + + +back + +

User Message Output Module

Module Name: omusrmsg

Author: Rainer Gerhards <rgergards@adiscon.com>

Description:

The omusrmsg plug-in provides the core functionality for logging output to a logged on user. It is a built-in module that does not need to be loaded.

+ +

Global Configuration Directives:

Template [templateName]
+ sets a new default template for file actions.

Action specific Configuration Directives:

Users string
+ Must be a valid user name or root.

Caveats/Known Bugs:

None.

Sample:

The following command sends all critical syslog messages to a user and to root.

+ + +

+ +

Legacy Configuration Directives:

+ No specific configuration directives available. See configuration sample below for details on using the plugin. +

+ +

Legacy Sample:

The following command sends all critical syslog messages to a user and to root.

+ + + +

[rsyslog.conf overview] [manual +index] [rsyslog site]

This documentation is part of the +rsyslog project.
+Copyright © 2008 by Rainer Gerhards and +Adiscon. Released under the GNU GPL +version 3 or higher.

+ + diff --git a/doc/rsyslog_conf_global.html b/doc/rsyslog_conf_global.html index 6c20f4c2..a4d760eb 100644 --- a/doc/rsyslog_conf_global.html +++ b/doc/rsyslog_conf_global.html @@ -52,10 +52,10 @@ This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered. -

$ActionFileDefaultTemplate [templateName] - sets a new default template for file actions

$ActionFileEnableSync [on/off] - enables file +

$ActionFileDefaultTemplate [templateName] - sets a new default template for file actions

$ActionFileEnableSync [on/off] - enables file syncing capability of omfile

$ActionForwardDefaultTemplate [templateName] - sets a new +

$ActionForwardDefaultTemplate [templateName] - sets a new default template for UDP and plain TCP forwarding action

$ActionGSSForwardDefaultTemplate [templateName] - sets a new default template for GSS-API forwarding action

@@ -93,23 +93,23 @@ default 60000 (1 minute)]

$ActionQueueWorkerThreadMinumumMessages <number>, default 100

$ActionResumeInterval

$ActionResumeRetryCount <number> [default 0, -1 means eternal]

$ActionSendResendLastMsgOnReconnect <[on/off]> specifies if the last message is to be resend when a connecition breaks and has been reconnected. May increase reliability, but comes at the risk of message duplication. -

$ActionSendStreamDriver <driver basename> just like $DefaultNetstreamDriver, but for the specific action

$ActionSendStreamDriverMode <mode>, default 0, mode to use with the stream driver (driver-specific)

$ActionSendStreamDriverAuthMode <mode>, authentication mode to use with the stream driver. Note that this directive requires TLS +

$ActionSendStreamDriver <driver basename> just like $DefaultNetstreamDriver, but for the specific action

$ActionSendStreamDriverMode <mode>, default 0, mode to use with the stream driver (driver-specific)

$ActionSendStreamDriverAuthMode <mode>, authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)

$ActionSendStreamDriverPermittedPeer <ID>, accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS +

$ActionSendStreamDriverPermittedPeer <ID>, accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific) - directive may go away!

$ActionSendTCPRebindInterval nbr- [available since 4.5.1] - instructs the TCP send +

$ActionSendTCPRebindInterval nbr- [available since 4.5.1] - instructs the TCP send action to close and re-open the connection to the remote host every nbr of messages sent. Zero, the default, means that no such processing is done. This directive is useful for use with load-balancers. Note that there is some performance overhead associated with it, so it is advisable to not too often "rebind" the connection (what "too often" actually means depends on your configuration, a rule of thumb is that it should be not be much more often than once per second).

$ActionSendUDPRebindInterval nbr- [available since 4.3.2] - instructs the UDP send +

$ActionSendUDPRebindInterval nbr- [available since 4.3.2] - instructs the UDP send action to rebind the send socket every nbr of messages sent. Zero, the default, means that no rebind is done. This directive is useful for use with load-balancers.

$ActionWriteAllMarkMessages [on/off]- [available since 5.1.5] - normally, mark messages @@ -133,22 +133,22 @@ functionality. the provided name (the default default ruleset is named "RSYSLOG_DefaultRuleset"). It is advised to also read our paper on using multiple rule sets in rsyslog.

$CreateDirs [on/off] - create directories on an as-needed basis

$DirCreateMode

$DirGroup

$DirOwner

$CreateDirs [on/off] - create directories on an as-needed basis

$DirCreateMode

$DirGroup

$DirOwner

$DropMsgsWithMaliciousDnsPTRRecords

$DropTrailingLFOnReception

$DynaFileCacheSize

$Escape8BitCharactersOnReceive

$EscapeControlCharactersOnReceive

$EscapeControlCharactersOnReceive [on|off] - escape USASCII HT character

$SpaceLFOnReceive [on/off] - instructs rsyslogd to replace LF with spaces during message reception (sysklogd compatibility aid)

$ErrorMessagesToStderr [on|off] - direct rsyslogd error message to stderr (in addition to other targets)

$GssForwardServiceName

$GssListenServiceName

@@ -224,7 +224,7 @@ supported in order to be compliant to the upcoming new syslog RFC series.

$MaxOpenFiles

$ModDir

$ModLoad

$OMFileAsyncWriting [on/off], if turned on, the files will be written +

$OMFileAsyncWriting [on/off], if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable $OMFileFlushInterval, $OMFileAsyncWriting must be set to "on". Otherwise, the flush @@ -232,11 +232,11 @@ interval will be ignored. Also note that when $OMFileFlushOnTXEnd is "on" but $OMFileAsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal. -

$OMFileZipLevel 0..9 [default 0] - if greater 0, turns on gzip compression +

$OMFileZipLevel 0..9 [default 0] - if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.

$OMFileIOBufferSize <size_nbr>, default 4k, size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)

$OMFileFlushOnTXEnd <[on/off]>, default on. Omfile has the +

$OMFileFlushOnTXEnd <[on/off]>, default on. Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where @@ -246,7 +246,7 @@ error recovery thus can handle write errors without data loss. Note that this op severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour.

$omfileForceChown - force ownership change for all files

$RepeatedMsgContainsOriginalMsg [on/off] - "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most diff --git a/doc/rsyslog_conf_modules.html b/doc/rsyslog_conf_modules.html index 650e20ad..cbd60faf 100644 --- a/doc/rsyslog_conf_modules.html +++ b/doc/rsyslog_conf_modules.html @@ -51,6 +51,10 @@ to message generators.

Output modules process messages. With them, message formats can be transformed and messages be transmitted to various different targets.

omfile - file output module
omfwd - syslog forwarding output module
ompipe - named pipe output module
omusrmsg - user message output module
omsnmp - SNMP trap output module
omtdout - stdout output module (mainly a test tool)
omrelp - RELP output module