Provides the ability to receive syslog messages via plain TCP syslog. This is a specialised input plugin tailored for high performance on Linux. It will probably not run on any other platform. Also, it does not provide TLS services. Encryption can be provided by using stunnel.
This module has no limit on the number of listeners and sessions that can be used.
Author:Rainer Gerhards <rgerhards@adiscon.com>
This plugin has config directives similar named as imtcp, but they all have PTCP in their name instead of just TCP. Note that only a subset of the parameters are supported.
These paramters can be used with the “module()” statement. They apply globaly to all inputs defined by the module.
These parameters can be used with the “input()” statement. They apply to the input they are specified with.
Note that a similar, but worse, issue exists with Cisco’s IOS implementation. They do not use any framing at all. This is confirmed from Cisco’s side, but there seems to be very limited interest in fixing this issue. This directive can not fix the Cisco bug. That would require much more code changes, which I was unable to do so far. Full details can be found at the Cisco tcp syslog anomaly page.
Defaults to “on”
The legacy octed-counted framing (similar to RFC5425 framing) is activated. This is the default and should be left unchanged until you know very well what you do. It may be useful to turn it off, if you know this framing is not used and some senders emit multi-line messages into the message stream.
Defaults to off
instructs imptcp to emit a message if the remote peer closes a connection.
Defaults to off
enable of disable keep-alive packets at the tcp socket layer. The default is to disable them.
The number of unacknowledged probes to send before considering the connection dead and notifying the application layer. The default, 0, means that the operating system defaults are used. This has only effect if keep-alive is enabled. The functionality may not be available on all platforms.
The interval between subsequential keepalive probes, regardless of what the connection has exchanged in the meantime. The default, 0, means that the operating system defaults are used. This has only effect if keep-alive is enabled. The functionality may not be available on all platforms.
The interval between the last data packet sent (simple ACKs are not considered data) and the first keepalive probe; after the connection is marked to need keepalive, this counter is not used any further. The default, 0, means that the operating system defaults are used. This has only effect if keep-alive is enabled. The functionality may not be available on all platforms.
Select a port to listen on
Sets a name for the inputname property. If no name is set “imptcp” is used by default. Setting a name is not strictly necessary, but can be useful to apply filtering based on which input the message was received from.
Binds specified ruleset to next server defined.
On multi-homed machines, specifies to which local address the listerner should be bound.
Default is 0, which turns off rate limiting
Specifies the rate-limiting interval in seconds. Set it to a number of seconds (5 recommended) to activate rate-limiting.
Default is 10,000
Specifies the rate-limiting burst in number of messages.
This sets up a TCP server on port 514:
module(load="imptcp") # needs to be done just once
input(type="imptcp" port="514")
Equivalent to: AddTLFrameDelimiter
Equivalent to: SupportOctetCountedFraming
Equivalent to: ServerNotifyOnConnectionClose.
Equivalent to: KeepAlive
Equivalent to: KeepAlive.Probes
Equivalent to: KeepAlive.Interval
Equivalent to: KeepAlive.Time
Equivalent to: Port
Equivalent to: Name
Equivalent to: Ruleset
Equivalent to: threads
Equivalent to: Address
This sets up a TCP server on port 514:
$ModLoad imptcp # needs to be done just once
$InputPTCPServerRun 514