TCP (om_tcp)

This module initiates a TCP connection to a remote host and transfers log messages. Or, when using the ListenAddr directive, this module accepts client connections and multiplexes data to all connected clients. The TCP transfer protocol provides more reliable log transmission than UDP. If security is a concern, consider using the om_ssl module instead.

To examine the supported platforms, see the list of installation packages.

Configuration

The om_tcp module accepts the following directives in addition to the common module directives. The Host or ListenAddr directive is required.

Required directives

One of the following mutually exclusive directives is required for the module to start.

Host

Set this directive to the IP address or hostname of the remote host to connect to. If you specify a hostname, the module resolves it to an IP address on each new connection.

The module uses port 514 by default. To connect to a different port, add the port number after the IP address or hostname, separated by a colon (host:port).

Enclose IPv6 addresses in square brackets ([addr]:port). For example, [2001:0db8:85a3:0:0:8a2e:0370:7334]:514.

You can set this directive more than once to allow failover between different hosts or ports. List IPv4 and IPv6 addresses separately if needed. If you use a DNS name, make sure it resolves to fewer than 16 addresses or CNAMEs to prevent problems with DNS response size limits.

If you configure more than one Host directive, or a DNS lookup returns multiple addresses, the module connects to the first reachable address and stays connected until it stops or the connection drops. It does not detect DNS changes on its own.

If a connection attempt fails, the module tries the next address in the current Host directive, then moves to the next Host directive, if any. Once it checks all Host directives, it starts over from the first and keeps trying until it connects.

ListenAddr

Set this directive to the IP address or DNS hostname on which the module accepts connections. The default is localhost, which restricts access to the local machine and prevents connections from remote hosts.

Append the port number to the address using a colon separator (host:port). The default port is 514. For IPv6 addresses, enclose the address in square brackets ([addr]:port). Use 0.0.0.0:514 for IPv4 or [::]:514 for IPv6 to accept connections on all interfaces. NXLog Agent requires additional privileges to bind to ports below 1024 on Linux. See Granting additional Linux capabilities for more information.

You can specify this directive multiple times to accept connections on multiple addresses or ports within a single module instance. Set IPv4 and IPv6 addresses as separate entries. If you use a DNS name, keep the number of addresses or CNAMEs below 16 to avoid errors caused by DNS response size limits.

Listen-mode directives

The following directives are available when using the ListenAddr directive.

AllowIP

Set this directive to restrict incoming connections to specific IP addresses or networks. You can specify this directive multiple times to allow multiple IPs or networks. AllowIP has no effect unless ListenAddr is configured.

If AllowIP is not set, the module falls back to BlockIP to deny specific connections. If neither AllowIP nor BlockIP is set, the module does not restrict incoming connections.

The following IP address formats may be used:

0.0.0.0 (IPv4 address)
0.0.0.0/32 (IPv4 network with subnet bits)
0.0.0.0/0.0.0.0 (IPv4 network with subnet address)
aa::1 (IPv6 address)
aa::12/64 (IPv6 network with subnet bits)

BlockIP

Set this directive to deny incoming connections from specific IP addresses or networks. You can specify this directive multiple times to deny multiple IPs or networks. BlockIP has no effect unless ListenAddr is configured.

If BlockIP is not set, the module falls back to AllowIP to restrict incoming connections. If neither BlockIP nor AllowIP is set, the module does not restrict incoming connections.

The following IP address formats may be used:

0.0.0.0 (IPv4 address)
0.0.0.0/32 (IPv4 network with subnet bits)
0.0.0.0/0.0.0.0 (IPv4 network with subnet address)
aa::1 (IPv6 address)
aa::12/64 (IPv6 network with subnet bits)

MaxConnections

Set this directive to limit the number of concurrent active connections for a listening TCP socket. The default is 4294967295 (unlimited). When the limit is reached, the module rejects new connections and logs an error:

Number of allowed active connections(10) reached: 10. Refusing connection from 127.0.0.1

ConnectionIdleTimeout

Set this directive to close TCP connections that have been idle for longer than the specified number of seconds. The minimum value is 15 seconds. If this directive is not set, the module keeps idle TCP connections open indefinitely.

ExclusiveAddrUse

Set this directive to TRUE to prevent other processes or module instances from binding to the same port.

The default is FALSE; multiple module instances can bind to the same port.

This directive is only supported on Windows.

ReuseAddr

Set this directive to TRUE to allow the module instance to bind to a port that is already in use.

The default is TRUE; multiple module instances can listen on the same port and process data simultaneously.

ReusePort

Set this directive to TRUE to allow multiple module instances to listen on the same port. Each instance runs in a separate thread, allowing NXLog Agent to process incoming logs simultaneously.

The default is FALSE; multiple module instances cannot bind to the same port.

This directive is not supported on Windows.

Optional directives

LocalPort

Set this directive to the local port number to use for the connection, for example to satisfy a firewall rule that expects traffic from a known port. If you do not set this directive, the module uses a random high port number, which a firewall may block. This directive only applies when the module uses Host instead of ListenAddr.

Attempts to bind to LocalPort may fail because of the required TIME-WAIT delay in closing connections. When this happens, the module writes Address already in use to the NXLog Agent log file. If it persists, it can degrade network performance.

OutputType

See the OutputType directive in the list of common module directives. The default is LineBased_LF.

QueueInListenMode

If set to TRUE, this boolean directive specifies that events should be queued if no client is connected. If this module’s buffer becomes full, the preceding module in the route will be paused or events will be dropped, depending on whether FlowControl is enabled. This directive only applies if ListenAddr is used instead of Host. The default is FALSE: om_tcp will discard events if no client is connected.

Reconnect

Set this directive to the number of seconds to wait between reconnection attempts. If you do not set this directive, the module starts with a 1 second interval and doubles it after each failed attempt, resetting to 1 second once it reconnects successfully.

Setting this directive on multiple systems can cause them to send reconnection requests to the same destination at the same time, potentially overloading it. This can also cause NXLog Agent to consume unusually high system resources or become unresponsive.

ReconnectOnData

Set this directive to TRUE to have the module reconnect to the remote host only when it has data to send, instead of keeping the connection open at all times. The default is FALSE; the module always keeps a connection open with the remote host.

TCPNoDelay

Set this directive to TRUE to deactivate Nagle’s algorithm and send packets immediately instead of buffering small writes into larger frames. Nagle’s algorithm normally merges small outgoing packets and waits for an acknowledgment before sending the next one, which reduces network overhead but adds latency. The default is FALSE; the module does not set the TCP_NODELAY socket option, so Nagle’s algorithm remains active.

TcpSendStallDetect

Set this directive to TRUE to monitor for pipeline backpressure by logging a warning whenever the module cannot send data to the destination. The module writes the following message to the NXLog Agent log file:

TCP send buffer full for <instance_name> - write blocked

The default is FALSE; the module does not check for send stalls.

TCP connections are kept alive by keep-alive packets. This feature is enabled by default and cannot be disabled.

Procedures

The following procedures are exported by om_tcp.

reconnect();

Force a reconnection. This can be used from a Schedule block to periodically reconnect to the server.

The reconnect() procedure must be used with caution. If configured, it can attempt to reconnect after every event sent, potentially overloading the destination system.

Examples

Example 1. Sending logs over TCP

With this configuration, NXLog Agent will read log messages from a socket and forward them via TCP.

nxlog.conf

<Input uds>
    Module  im_uds
    UDS     /dev/log
</Input>

<Output tcp>
    Module  om_tcp
    Host    192.168.1.1:1514
</Output>

<Route uds_to_tcp>
    Path    uds => tcp
</Route>

Example 2. Sending logs over TCP with failover

This configuration sends logs via TCP in a failover configuration (multiple Hosts defined).

nxlog.conf

<Output tcp>
    Module  om_tcp
    Host    192.168.1.2:1514
    Host    192.168.1.3:1234
    Host    example.com:1234
</Output>