Unix Socket Input

Module Name: imuxsock

Author: Rainer Gerhards <rgerhards@adiscon.com>

Description:

Provides the ability to accept syslog messages via local Unix sockets. Most importantly, this is the mechanism by which the syslog(3) call delivers syslog messages to rsyslogd. So you need to have this module loaded to read the system log socket and be able to process log messages from applications running on the local system.

Application-provided timestamps are ignored by default. This is needed, as some programs (e.g. sshd) log with inconsistent timezone information, what messes up the local logs (which by default don't even contain time zone information). This seems to be consistent with what sysklogd did for the past four years. Alternate behaviour may be desirable if gateway-like processes send messages via the local log slot - in this case, it can be enabled via the $InputUnixListenSocketIgnoreMsgTimestamp and $SystemLogSocketIgnoreMsgTimestamp config directives

Configuration Directives:

$InputUnixListenSocketIgnoreMsgTimestamp [on/off]
Ignore timestamps included in the message. Applies to the next socket being added.
$SystemLogSocketIgnoreMsgTimestamp [on/off]
Ignore timestamps included in the messages, applies to messages received via the system log socket.
$OmitLocalLogging (imuxsock) [on/off] -- former -o option
$SystemLogSocketName <name-of-socket> -- former -p option
$AddUnixListenSocket <name-of-socket> adds additional unix socket, default none -- former -a option

Caveats/Known Bugs:

This documentation is sparse and incomplete.

Sample:

The following sample is the minimum setup required to accept syslog messages from applications running on the local system.

[rsyslog.conf overview] [manual index] [rsyslog site]