mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-22 01:20:42 +01:00
107 lines
4.3 KiB
HTML
107 lines
4.3 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Language" content="en">
|
|
<title>UDP Syslog Input Module (imudp)</title>
|
|
</head>
|
|
|
|
<body>
|
|
<a href="rsyslog_conf_modules.html">back to rsyslog module overview</a>
|
|
|
|
<h1>UDP Syslog Input Module</h1>
|
|
<p><b>Module Name: imudp</b></p>
|
|
<p><b>Author: </b>Rainer Gerhards <rgerhards@adiscon.com></p>
|
|
<p><b>Multi-Ruleset Support: </b>since 5.3.2
|
|
<p><b>Description</b>:</p>
|
|
<p>Provides the ability to receive syslog messages via UDP.
|
|
<p>Multiple receivers may be configured by specifying
|
|
multiple input actions.
|
|
</p>
|
|
|
|
<p><b>Configuration Directives</b>:</p>
|
|
<p><b>Global Directives</b>:</p>
|
|
<ul>
|
|
<li><b>TimeRequery</b> <nbr-of-times><br>
|
|
this is a performance
|
|
optimization. Getting the system time is very costly. With this setting, imudp can
|
|
be instructed to obtain the precise time only once every n-times. This logic is
|
|
only activated if messages come in at a very fast rate, so doing less frequent
|
|
time calls should usually be acceptable. The default value is two, because we have
|
|
seen that even without optimization the kernel often returns twice the identical time.
|
|
You can set this value as high as you like, but do so at your own risk. The higher
|
|
the value, the less precise the timestamp.
|
|
<li><b>SchedulingPolicy</b> <rr/fifo/other><br>
|
|
Can be used the set the scheduler priority, if the necessary functionality
|
|
is provided by the platform. Most useful to select "fifo" for real-time
|
|
processing under Linux (and thus reduce chance of packet loss).
|
|
<li><b>SchedulingPriority</b> <number><br>
|
|
Scheduling priority to use.
|
|
</ul>
|
|
<p><b>Action Directives</b>:</p>
|
|
<ul>
|
|
<li><b>Address</b> <IP><br>
|
|
local IP address (or name) the UDP listens should bind to</li>
|
|
<li><b>Port</b> <port><br>
|
|
default 514, start UDP server on this port. Either a single port can be specified or an array of ports. If multiple ports are specified, a listener will be automatically started for each port. Thus, no additional inputs need to be configured.
|
|
<br>Single port: Port="514"
|
|
<br>Array of ports: Port=["514","515","10514","..."]</li>
|
|
<li><b>Ruleset</b> <ruleset><br>
|
|
Binds the listener to a specific <a href="multi_ruleset.html">ruleset</a>.</li>
|
|
<li><b>RateLimit.Interval</b> [number] - (available since 7.3.1) specifies the rate-limiting
|
|
interval in seconds. Default value is 0, which turns off rate limiting. Set it to a number
|
|
of seconds (5 recommended) to activate rate-limiting.
|
|
</li>
|
|
<li><b>RateLimit.Burst</b> [number] - (available since 7.3.1) specifies the rate-limiting
|
|
burst in number of messages. Default is 10,000.
|
|
</li>
|
|
</ul>
|
|
<b>Caveats/Known Bugs:</b>
|
|
<ul>
|
|
<li>currently none known</li>
|
|
</ul>
|
|
<p><b>Sample:</b></p>
|
|
<p>This sets up an UPD server on port 514:<br>
|
|
</p>
|
|
<textarea rows="15" cols="60">module(load="/folder/to/rsyslog/plugins/imudp/.libs/imudp") # needs to be done just once
|
|
input(type="imudp" port="514")
|
|
</textarea>
|
|
|
|
<p><b>Legacy Configuration Directives</b>:</p>
|
|
<p>Multiple receivers may be configured by specifying
|
|
$UDPServerRun multiple times.
|
|
</p>
|
|
<ul>
|
|
<li>$UDPServerAddress <IP><br>
|
|
equivalent to: Address </li>
|
|
<li>$UDPServerRun <port><br>
|
|
equivalent to: Port </li>
|
|
<li>$UDPServerTimeRequery <nbr-of-times><br>
|
|
equivalent to: TimeRequery
|
|
<li>$InputUDPServerBindRuleset <ruleset><br>
|
|
equivalent to: Ruleset </li>
|
|
<li>$IMUDPSchedulingPolicy <rr/fifo/other> Available since 4.7.4+, 5.7.3+, 6.1.3+.<br>
|
|
equivalent to: SchedulingPolicy
|
|
<li>$IMUDPSchedulingPriority <number> Available since 4.7.4+, 5.7.3+, 6.1.3+.<br>
|
|
equivalent to: SchedulingPriority
|
|
</ul>
|
|
<b>Caveats/Known Bugs:</b>
|
|
<ul>
|
|
<li>currently none known</li>
|
|
</ul>
|
|
<p><b>Sample:</b></p>
|
|
<p>This sets up an UPD server on port 514:<br>
|
|
</p>
|
|
<textarea rows="15" cols="60">$ModLoad imudp # needs to be done just once
|
|
$UDPServerRun 514
|
|
</textarea>
|
|
<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>]
|
|
[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
|
|
<p><font size="2">This documentation is part of the
|
|
<a href="http://www.rsyslog.com/">rsyslog</a>
|
|
project.<br>
|
|
Copyright © 2009 by <a href="http://www.gerhards.net/rainer">Rainer
|
|
Gerhards</a> and
|
|
<a href="http://www.adiscon.com/">Adiscon</a>.
|
|
Released under the GNU GPL version 3 or higher.</font></p>
|
|
</body></html>
|