TCP¶
Receive the unstructured syslog messages over TCP.
Available options:
reuse_port
: false
¶
New in version 0.6.0.
Enable or disable SO_REUSEPORT
on listener’s socket.
Example:
listener:
tcp:
reuse_port: true
max_clients
: 5
¶
The maximum number of parallel connections to accept.
Example:
listener:
tcp:
max_clients: 100
framing
: traditional
¶
New in version 0.10.0.
Framing mode used when receiving messages. Available options: traditional
or octet-counted
.
In protocol engineering, framing means how multiple messages over the same
connection are separated. Usually, this is transparent to users. Unfortunately,
the early syslog protocol evolved and so there are cases where users need to
specify the framing. The traditional
framing is nontransparent. With it,
messages end when an LF (i.e., line break / return) is encountered, and the next
message starts immediately after the LF. If multi-line messages are received,
these are essentially broken up into multiple message, usually with all but the
first message segment being incorrectly formatted. The octet-counted
framing
solves this issue. With it, each message is prefixed with the actual message
length, so that a receiver knows exactly where the message ends. Multi-line
messages cause no problem here. This mode is very close to the method described
in RFC5425 for TLS-enabled syslog. Unfortunately, only few syslogd
implementations support octet-counted
framing. As such, the traditional
framing is set as default, even though it has defects. If it is known that the
transmitter supports octet-counted
framing, it is suggested to use that
framing mode.
(Detailed documentation notes based on `<rsyslog omfwd> https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html#tcp-framing`__)
frame_delimiter
: \n
¶
New in version 0.10.0.
Sets a custom frame delimiter for TCP transmission when framing
is
configured in traditional
mode. The delimiter has to be a number between
0 and 255 (representing the ASCII-code of said character). The default value for
this parameter is 10, representing a \n
.