back to rsyslog module overview

# UDP Syslog Input Module

Module Name: imudp

Author: Rainer Gerhards <rgerhards@adiscon.com>

Multi-Ruleset Support: since 5.3.2

Description:

Provides the ability to receive syslog messages via UDP.

Multiple receivers may be configured by specifying multiple input actions.

Configuration Directives:

Global Directives:

- TimeRequery <nbr-of-times>
  this is a performance optimization. Getting the system time is very costly. With this setting, imudp can be instructed to obtain the precise time only once every n-times. This logic is only activated if messages come in at a very fast rate, so doing less frequent time calls should usually be acceptable. The default value is two, because we have seen that even without optimization the kernel often returns twice the identical time. You can set this value as high as you like, but do so at your own risk. The higher the value, the less precise the timestamp.
- SchedulingPolicy <rr/fifo/other>
  Can be used the set the scheduler priority, if the necessary functionality is provided by the platform. Most useful to select "fifo" for real-time processing under Linux (and thus reduce chance of packet loss).
- SchedulingPriority <number>
  Scheduling priority to use.

Action Directives:

- Address <IP>
  local IP address (or name) the UDP listens should bind to
- Port <port>
  default 514, start UDP server on this port. Either a single port can be specified or an array of ports. If multiple ports are specified, a listener will be automatically started for each port. Thus, no additional inputs need to be configured.
  Single port: Port="514"
  Array of ports: Port=["514","515","10514","..."]
- Ruleset <ruleset>
  Binds the listener to a specific ruleset.

Caveats/Known Bugs:

- Scheduling parameters are set after privileges have been dropped. In most cases, this means that setting them will not be possible after privilege drop. This may be worked around by using a sufficiently-privileged user account.

Sample:

This sets up an UPD server on port 514:

module(load="imudp") # needs to be done just once input(type="imudp" port="514")

Legacy Configuration Directives:

Multiple receivers may be configured by specifying $UDPServerRun multiple times.

- $UDPServerAddress <IP>
  equivalent to: Address
- $UDPServerRun <port>
  equivalent to: Port
- $UDPServerTimeRequery <nbr-of-times>
  equivalent to: TimeRequery
- $InputUDPServerBindRuleset <ruleset>
  equivalent to: Ruleset
- $IMUDPSchedulingPolicy <rr/fifo/other> Available since 4.7.4+, 5.7.3+, 6.1.3+.
  equivalent to: SchedulingPolicy
- $IMUDPSchedulingPriority <number> Available since 4.7.4+, 5.7.3+, 6.1.3+.
  equivalent to: SchedulingPriority

Caveats/Known Bugs:

- currently none known

Sample:

This sets up an UPD server on port 514:

$ModLoad imudp # needs to be done just once $UDPServerRun 514

[rsyslog.conf overview] [manual index] [rsyslog site]

This documentation is part of the rsyslog project.
Copyright © 2009 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.