1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head>
<meta http-equiv="Content-Language" content="en">
<title>Plain TCP Syslog Input Module (imptcp)</title></head>
<body>
<a href="rsyslog_conf_modules.html">back</a>
<h1>Plain TCP Syslog Input Module</h1>
<p><b>Module Name: imptcp</b></p>
<p><b>Available since: </b>4.7.3+, 5.5.8+
<p><b>Author: </b>Rainer Gerhards
<rgerhards@adiscon.com></p>
<p><b>Description</b>:</p>
<p>Provides the ability to receive syslog messages via plain TCP syslog.
This is a specialised input plugin tailored for high performance on Linux. It will
probably not run on any other platform. Also, it does no provide TLS services.
Encryption can be provided by using <a href="rsyslog_stunnel.html">stunnel</a>.
<p>This module has no limit on the number of listeners and sessions that can be used.
<p>Multiple receivers may be configured by
specifying $InputPTCPServerRun multiple times.
</p>
<p><b>Configuration Directives</b>:</p>
<p>This plugin has config directives similar named as imtcp, but they all have <b>P</b>TCP in
their name instead of just TCP. Note that only a subset of the parameters are supported.
<ul>
<li>$InputPTCPServerAddtlFrameDelimiter <Delimiter><br>
This directive permits to specify an additional frame delimiter for plain tcp syslog.
The industry-standard specifies using the LF character as frame delimiter. Some vendors,
notable Juniper in their NetScreen products, use an invalid frame delimiter, in Juniper's
case the NUL character. This directive permits to specify the ASCII value of the delimiter
in question. Please note that this does not guarantee that all wrong implementations can
be cured with this directive. It is not even a sure fix with all versions of NetScreen,
as I suggest the NUL character is the effect of a (common) coding error and thus will
probably go away at some time in the future. But for the time being, the value 0 can
probably be used to make rsyslog handle NetScreen's invalid syslog/tcp framing.
For additional information, see this
<a href="http://kb.monitorware.com/problem-with-netscreen-log-t1652.html">forum thread</a>.
<br><b>If this doesn't work for you, please do not blame the rsyslog team. Instead file
a bug report with Juniper!</b>
<br>Note that a similar, but worse, issue exists with Cisco's IOS implementation. They do
not use any framing at all. This is confirmed from Cisco's side, but there seems to be
very limited interest in fixing this issue. This directive <b>can not</b> fix the Cisco bug.
That would require much more code changes, which I was unable to do so far. Full details
can be found at the <a href="http://www.rsyslog.com/Article321.phtml">Cisco tcp syslog anomaly</a>
page.
<li><b>$InputPTCPSupportOctetCountedFraming</b> <<b>on</b>|off><br>
If set to "on", the legacy octed-counted framing (similar to RFC5425 framing) is
activated. This is the default and should be left unchanged until you know
very well what you do. It may be useful to turn it off, if you know this framing
is not used and some senders emit multi-line messages into the message stream.
</li>
<li>$InputPTCPServerNotifyOnConnectionClose [on/<b>off</b>]<br>
instructs imptcp to emit a message if the remote peer closes a connection.<br>
<li><b>$InputPTCPServerKeepAlive</b> <on/<b>off</b>><br>
enable of disable keep-alive packets at the tcp socket layer. The default is
to disable them.</li>
<li><b>$InputPTCPServerKeepAlive_probes</b> <number><br>
The number of unacknowledged probes to send before considering the connection dead and notifying the application layer.
The default, 0, means that the operating system defaults are used. This has only
effect if keep-alive is enabled. The functionality may not be available on
all platforms.
<li><b>$InputPTCPServerKeepAlive_intvl</b> <number><br>
The interval between subsequential keepalive probes, regardless of what the connection has exchanged in the meantime.
The default, 0, means that the operating system defaults are used. This has only
effect if keep-alive is enabled. The functionality may not be available on
all platforms.
<li><b>$InputPTCPServerKeepAlive_time</b> <number><br>
The interval between the last data packet sent (simple ACKs are not considered data) and the first keepalive probe; after the connection is marked to need keepalive, this counter is not used any further.
The default, 0, means that the operating system defaults are used. This has only
effect if keep-alive is enabled. The functionality may not be available on
all platforms.
<li><b>$InputPTCPServerRun</b> <port><br>
Starts a TCP server on selected port</li>
<li>$InputPTCPServerInputName <name><br>
Sets a name for the inputname property. If no name is set "imptcp" is used by default. Setting a
name is not strictly necessary, but can be useful to apply filtering based on which input
the message was received from.
<li>$InputPTCPServerBindRuleset <name><br>
Binds specified ruleset to next server defined.
<li>$InputPTCPHelperThreads <number><br>
Number of helper worker threads to process incoming messages. These
threads are utilized to pull data off the network. On a busy system, additional
helper threads (but not more than there are CPUs/Cores) can help improving
performance. The default value is two.
<li>$InputPTCPServerListenIP <name><br>
On multi-homed machines, specifies to which local address the next listerner should
be bound.
</ul>
<b>Caveats/Known Bugs:</b>
<ul>
<li>module always binds to all interfaces</li>
</ul>
<p><b>Sample:</b></p>
<p>This sets up a TCP server on port 514:<br>
</p>
<textarea rows="15" cols="60">$ModLoad imptcp #
needs to be done just once
$InputPTCPServerRun 514
</textarea>
<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>]
[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
<p><font size="2">This documentation is part of the
<a href="http://www.rsyslog.com/">rsyslog</a>
project.<br>
Copyright © 2010 by <a href="http://www.gerhards.net/rainer">Rainer
Gerhards</a> and
<a href="http://www.adiscon.com/">Adiscon</a>.
Released under the GNU GPL version 3 or higher.</font></p>
</body></html>
|
