From 4ae631d3cd8435552dc7aaa604d79cf4a3634c99 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Thu, 27 Nov 2025 16:39:01 +0100 Subject: [PATCH 1/2] Updated syslogd input plugin doc for new octet counting support. Fixes #2211. Signed-off-by: Eric D. Schabell --- pipeline/inputs/syslog.md | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/pipeline/inputs/syslog.md b/pipeline/inputs/syslog.md index 940f7ea1d..4c0f860cd 100644 --- a/pipeline/inputs/syslog.md +++ b/pipeline/inputs/syslog.md @@ -8,17 +8,19 @@ The plugin supports the following configuration parameters: | Key | Description | Default | |:----------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------| -| `Mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` | -| `Listen` | If `Mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` | -| `Port` | If `Mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` | -| `Path` | If `Mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ | -| `Unix_Perm` | If `Mode` is set to `unix_tcp` or `unix_udp`, set the permission of the Unix socket file. | `0644` | -| `Parser` | Specify an alternative parser for the message. If `Mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog` messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ | -| `Buffer_Chunk_Size` | By default, the buffer to store the incoming `syslog` messages. Doesn't allocate the maximum memory allowed, instead it allocates memory when required. The rounds of allocations are set by `Buffer_Chunk_Size`. There are considerations when using `udp` or `unix_udp` mode. | `32KB` (set in code) | -| `Buffer_Max_Size` | Specify the maximum buffer size to receive a `syslog` message. If not set, the default size is the value of `Buffer_Chunk_Size`. | _none_ | -| `Receive_Buffer_Size` | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on `udp` or `unix_udp` sockets. For Linux, the value is capped by `sysctl net.core.rmem_max`. | _none_ | -| `Source_Address_Key` | Specify the key where the source address will be injected. | _none_ | -| `Threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | +| `buffer_chunk_size` | By default, the buffer to store the incoming `syslog` messages. Doesn't allocate the maximum memory allowed, instead it allocates memory when required. The rounds of allocations are set by `buffer_chunk_size`. There are considerations when using `udp` or `unix_udp` mode. | `32KB` (set in code) | +| `buffer_max_size` | Specify the maximum buffer size to receive a `syslog` message. If not set, the default size is the value of `buffer_chunk_size`. | _none_ | +| `format` | Specify the TCP framing format. Set to `octet_counting` for RFC 6587 compliant octet-counting framing, or `newline` for newline-delimited framing. Only applies to TCP modes (`tcp` or `unix_tcp`). | `newline` | +| `listen` | If `mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` | +| `mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` | +| `parser` | Specify an alternative parser for the message. If `mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog` messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ | +| `path` | If `mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ | +| `port` | If `mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` | +| `raw_message_key` | Specify the key where the original raw `syslog` message will be preserved. | _none_ | +| `receive_buffer_size` | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on `udp` or `unix_udp` sockets. For Linux, the value is capped by `sysctl net.core.rmem_max`. | _none_ | +| `source_address_key` | Specify the key where the source address will be injected. | _none_ | +| `threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | +| `unix_perm` | If `mode` is set to `unix_tcp` or `unix_udp`, set the permission of the Unix socket file. | `0644` | ### Considerations @@ -251,4 +253,4 @@ $OMUxSockSocket /tmp/fluent-bit.sock *.* :omuxsock: ``` -Make sure that the socket file is readable by `rsyslog` by modifying `Unix_Perm` key. +Make sure that the socket file is readable by `rsyslog` by modifying `unix_perm` key. From c349ea767eb3072d1e3a0bbf34615a80ae6f5d00 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Thu, 27 Nov 2025 17:13:48 +0100 Subject: [PATCH 2/2] Fixed removing extra back tick review commment. Signed-off-by: Eric D. Schabell --- pipeline/inputs/syslog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pipeline/inputs/syslog.md b/pipeline/inputs/syslog.md index 4c0f860cd..3d397ee57 100644 --- a/pipeline/inputs/syslog.md +++ b/pipeline/inputs/syslog.md @@ -13,7 +13,7 @@ The plugin supports the following configuration parameters: | `format` | Specify the TCP framing format. Set to `octet_counting` for RFC 6587 compliant octet-counting framing, or `newline` for newline-delimited framing. Only applies to TCP modes (`tcp` or `unix_tcp`). | `newline` | | `listen` | If `mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` | | `mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` | -| `parser` | Specify an alternative parser for the message. If `mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog` messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ | +| `parser` | Specify an alternative parser for the message. If `mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ | | `path` | If `mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ | | `port` | If `mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` | | `raw_message_key` | Specify the key where the original raw `syslog` message will be preserved. | _none_ |