TCP Syslog Input Module

Module Name: imtcp

Author: Rainer Gerhards <rgerhards@adiscon.com>

Description:

Provides the ability to receive syslog messages via TCP. Encryption can be provided by using stunnel (an alternative is the use the imgssapi modul).

In the future, multiple receivers may be configured by specifying $InputTCPServerRun multiple times. This is not currently supported.

Configuration Directives:

$InputTCPServerRun <port>
Starts a TCP server on selected port
- $InputTCPMaxSessions <number>
Sets the maximum number of sessions supported
$InputTCPServerStreamDriverMode <number>
Sets the driver mode for the currently selected network stream driver. <number> is driver specifc.
$InputTCPServerStreamDriverAuthMode <mode-string>
Sets the authentication mode for the currently selected network stream driver. <mode-string> is driver specifc.
$InputTCPServerStreamDriverPermittedPeer <id-string>
Sets permitted peer IDs. Only these peers are able to connect to the listener. <id-string> semantics depend on the currently selected AuthMode and network stream driver. PermittedPeers may not be set in anonymous modes.

Caveats/Known Bugs:

module always binds to all interfaces
only a single listener can be bound
can not be loaded together with imgssapi (which includes the functionality of imtcp)

Sample:

This sets up a TCP server on port 514: