NXLog User Guide

109.30. TCP (im_tcp)

This module accepts TCP connections on the configured address and port. It can handle multiple simultaneous connections. The TCP transfer protocol provides more reliable log transmission than UDP. If security is a concern, consider using the im_ssl module instead.

Note	This module provides no access control. Firewall rules can be used to deny connections from certain hosts.

109.30.1. Configuration

The im_tcp module accepts the following directives in addition to the common module directives.

Host: The module will accept connections on this IP address or DNS hostname. For security, the default listen address is localhost (the localhost loopback address is not accessible from the outside). To receive logs from remote hosts, the address specified here must be accessible. The any address 0.0.0.0 is commonly used here.

Port: The module will listen for incoming connections on this port number. The default port is 514 if this directive is not specified.

109.30.2. Fields

The following fields are used by im_tcp.

$raw_event (type: string): The received string.

$MessageSourceAddress (type: string): The IP address of the remote host.

109.30.3. Examples

Example 569. Using the im_tcp Module

With this configuration, NXLog will listen for TCP connections on port 1514 and write received log messages to file.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14

  <Input tcp>
    Module  im_tcp
    Host    0.0.0.0
    Port    1514
</Input>

<Output file>
    Module  om_file
    File    "tmp/output"
</Output>

<Route tcp_to_file>
    Path    tcp => file
</Route>