# imptcp: Plain TCP Syslog

Module Name: | imptcp
Author: | Rainer Gerhards <rgerhards@adiscon.com>

## Purpose

Provides the ability to receive syslog messages via plain TCP syslog. This is a specialized input plugin tailored for high performance on Linux. It will probably not run on any other platform. Also, it does not provide TLS services. Encryption can be provided by using stunnel.

This module has no limit on the number of listeners and sessions that can be used.

Note

Reverse DNS lookups for remote senders are cached. Set the TTL via Reverse DNS caching.

## Notable Features

- Statistic Counter

- Error Messages

## Configuration Parameters

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

### Module Parameters

Parameter | Summary
--- | ---
Threads | Sets the number of helper threads that pull data off the network.
MaxSessions | Limits the number of open sessions.
ProcessOnPoller | Processes messages on the poller thread when feasible to reduce resource use.

### Input Parameters

These parameters can be used with the “input()” statement. They apply to the input they are specified with.

Parameter | Summary
--- | ---
Port | Selects the TCP port on which to listen.
Path | Specifies a Unix-domain socket path for the listener.
DiscardTruncatedMsg | Discards the remaining part of a message after truncation.
FileOwner | Sets the owner of the Unix-domain socket by user name.
FileOwnerNum | Sets the owner of the Unix-domain socket by numeric UID.
FileGroup | Sets the group of the Unix-domain socket by group name.
FileGroupNum | Sets the group of the Unix-domain socket by numeric GID.
FileCreateMode | Sets access permissions for the Unix-domain socket.
FailOnChOwnFailure | Controls startup failure if changing socket owner, group, or mode fails.
Unlink | Unlinks a Unix-domain socket before listening and after closing.
Name | Sets the inputname property used for tagging messages and statistics.
Ruleset | Binds the specified ruleset to this input.
MaxFrameSize | Sets the maximum frame size when using octet counted mode.
MaxSessions | Limits the number of open sessions.
Address | Specifies the local address to bind the listener to.
AddtlFrameDelimiter | Defines an additional ASCII frame delimiter for non-standard senders.
SupportOctetCountedFraming | Enables legacy octet-counted framing similar to RFC5425.
NotifyOnConnectionClose | Emits a message when a remote peer closes the connection.
NotifyOnConnectionOpen | Emits a message when a remote peer opens a connection.
KeepAlive | Enables TCP keep-alive packets on the socket.
KeepAlive.Probes | Sets the number of unacknowledged keepalive probes before the connection is considered dead.
KeepAlive.Interval | Sets the interval between keepalive probes.
KeepAlive.Time | Sets idle time before the first keepalive probe is sent.
RateLimit.Interval | Specifies the rate-limiting interval in seconds.
RateLimit.Burst | Sets the rate-limiting burst size in number of messages.
Compression.mode | Selects decompression mode matching compression used by omfwd.
flowControl | Throttles the sender when the receiver queue is nearly full.
MultiLine | Detects a new message only when LF is followed by ‘<’ or end of input.
framing.delimiter.regex | Uses a regular expression to identify the start of the next message.
SocketBacklog | Sets the listen() backlog for pending TCP connections.
Defaulttz | Sets a default time zone string.
Framingfix.cisco.asa | Ignores a leading space after a line feed to work around Cisco ASA framing issues.
ListenPortFileName | Writes the port number being listened on into the specified file.

## Statistic Counter

This plugin maintains statistics for each listener. The statistic is named “imtcp” , followed by the bound address, listener port and IP version in parenthesis. For example, the counter for a listener on port 514, bound to all interfaces and listening on IPv6 is called “imptcp(*/514/IPv6)”.

The following properties are maintained for each listener:

- submitted - total number of messages submitted for processing since startup

## Error Messages

When a message is to long it will be truncated and an error will show the remaining length of the message and the beginning of it. It will be easier to comprehend the truncation.

## Caveats/Known Bugs

- module always binds to all interfaces

## Examples

### Example 1

This sets up a TCP server on port 514:

    module(load="imptcp") # needs to be done just once
    input(type="imptcp" port="514")

### Example 2

This creates a listener that listens on the local loopback interface, only.

    module(load="imptcp") # needs to be done just once
    input(type="imptcp" port="514" address="127.0.0.1")

### Example 3

Create a unix domain socket:

    module(load="imptcp") # needs to be done just once
    input(type="imptcp" path="/tmp/unix.sock" unlink="on")

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.