Skip to content

Commit 4ae631d

Browse files
eschabelleschabell
committed
Updated syslogd input plugin doc for new octet counting support. Fixes #2211.
Signed-off-by: Eric D. Schabell <eric@schabell.org>
1 parent 48cbc51 commit 4ae631d

File tree

1 file changed

+14
-12
lines changed

1 file changed

+14
-12
lines changed

‎pipeline/inputs/syslog.md‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,19 @@ The plugin supports the following configuration parameters:
88

99
| Key | Description | Default |
1010
|:----------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------|
11-
| `Mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` |
12-
| `Listen` | If `Mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` |
13-
| `Port` | If `Mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` |
14-
| `Path` | If `Mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ |
15-
| `Unix_Perm` | If `Mode` is set to `unix_tcp` or `unix_udp`, set the permission of the Unix socket file. | `0644` |
16-
| `Parser` | Specify an alternative parser for the message. If `Mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog` messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ |
17-
| `Buffer_Chunk_Size` | By default, the buffer to store the incoming `syslog` messages. Doesn't allocate the maximum memory allowed, instead it allocates memory when required. The rounds of allocations are set by `Buffer_Chunk_Size`. There are considerations when using `udp` or `unix_udp` mode. | `32KB` (set in code) |
18-
| `Buffer_Max_Size` | Specify the maximum buffer size to receive a `syslog` message. If not set, the default size is the value of `Buffer_Chunk_Size`. | _none_ |
19-
| `Receive_Buffer_Size` | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on `udp` or `unix_udp` sockets. For Linux, the value is capped by `sysctl net.core.rmem_max`. | _none_ |
20-
| `Source_Address_Key` | Specify the key where the source address will be injected. | _none_ |
21-
| `Threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` |
11+
| `buffer_chunk_size` | By default, the buffer to store the incoming `syslog` messages. Doesn't allocate the maximum memory allowed, instead it allocates memory when required. The rounds of allocations are set by `buffer_chunk_size`. There are considerations when using `udp` or `unix_udp` mode. | `32KB` (set in code) |
12+
| `buffer_max_size` | Specify the maximum buffer size to receive a `syslog` message. If not set, the default size is the value of `buffer_chunk_size`. | _none_ |
13+
| `format` | Specify the TCP framing format. Set to `octet_counting` for RFC 6587 compliant octet-counting framing, or `newline` for newline-delimited framing. Only applies to TCP modes (`tcp` or `unix_tcp`). | `newline` |
14+
| `listen` | If `mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` |
15+
| `mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` |
16+
| `parser` | Specify an alternative parser for the message. If `mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog` messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ |
17+
| `path` | If `mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ |
18+
| `port` | If `mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` |
19+
| `raw_message_key` | Specify the key where the original raw `syslog` message will be preserved. | _none_ |
20+
| `receive_buffer_size` | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on `udp` or `unix_udp` sockets. For Linux, the value is capped by `sysctl net.core.rmem_max`. | _none_ |
21+
| `source_address_key` | Specify the key where the source address will be injected. | _none_ |
22+
| `threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` |
23+
| `unix_perm` | If `mode` is set to `unix_tcp` or `unix_udp`, set the permission of the Unix socket file. | `0644` |
2224

2325
### Considerations
2426

@@ -251,4 +253,4 @@ $OMUxSockSocket /tmp/fluent-bit.sock
251253
*.* :omuxsock:
252254
```
253255

254-
Make sure that the socket file is readable by `rsyslog` by modifying `Unix_Perm` key.
256+
Make sure that the socket file is readable by `rsyslog` by modifying `unix_perm` key.

0 commit comments

Comments
 (0)