TCP (im_tcp)

This module accepts TCP connections on the configured address and port. It can handle multiple simultaneous connections. The TCP transfer protocol provides more reliable log transmission than UDP. If security is a concern, consider using the im_ssl module instead.

To examine the supported platforms, see the list of installation packages.

Configuration

The im_tcp module accepts the following directives in addition to the common module directives.

Optional directives

InputType

This directive is identical to the InputType common module directive.

The default is LineBased, meaning the module expects CRLF as the record terminator on Windows or LF on Unix.

ListenAddr

Set this directive to the IP address or DNS hostname on which the module accepts connections. The default is localhost, which restricts access to the local machine and prevents connections from remote hosts.

Append the port number to the address using a colon separator (host:port). The default port is 514. For IPv6 addresses, enclose the address in square brackets ([addr]:port). Use 0.0.0.0:514 for IPv4 or [::]:514 for IPv6 to accept connections on all interfaces. NXLog Agent requires additional privileges to bind to ports below 1024 on Linux. See Granting additional Linux capabilities for more information.

You can specify this directive multiple times to accept connections on multiple addresses or ports within a single module instance. Set IPv4 and IPv6 addresses as separate entries. If you use a DNS name, keep the number of addresses or CNAMEs below 16 to avoid errors caused by DNS response size limits.

AllowIP

Set this directive to restrict incoming connections to specific IP addresses or networks. You can specify this directive multiple times to allow multiple IPs or networks. AllowIP has no effect unless ListenAddr is configured.

If AllowIP is not set, the module falls back to BlockIP to deny specific connections. If neither AllowIP nor BlockIP is set, the module does not restrict incoming connections.

The following IP address formats may be used:

0.0.0.0 (IPv4 address)
0.0.0.0/32 (IPv4 network with subnet bits)
0.0.0.0/0.0.0.0 (IPv4 network with subnet address)
aa::1 (IPv6 address)
aa::12/64 (IPv6 network with subnet bits)

BlockIP

Set this directive to deny incoming connections from specific IP addresses or networks. You can specify this directive multiple times to deny multiple IPs or networks. BlockIP has no effect unless ListenAddr is configured.

If BlockIP is not set, the module falls back to AllowIP to restrict incoming connections. If neither BlockIP nor AllowIP is set, the module does not restrict incoming connections.

The following IP address formats may be used:

0.0.0.0 (IPv4 address)
0.0.0.0/32 (IPv4 network with subnet bits)
0.0.0.0/0.0.0.0 (IPv4 network with subnet address)
aa::1 (IPv6 address)
aa::12/64 (IPv6 network with subnet bits)

MaxConnections

Set this directive to limit the number of concurrent active connections for a listening TCP socket. The default is 4294967295 (unlimited). When the limit is reached, the module rejects new connections and logs an error:

Number of allowed active connections(10) reached: 10. Refusing connection from 127.0.0.1

ConnectionIdleTimeout

Set this directive to close TCP connections that have been idle for longer than the specified number of seconds. The minimum value is 15 seconds. If this directive is not set, the module keeps idle TCP connections open indefinitely.

ExclusiveAddrUse

Set this directive to TRUE to prevent other processes or module instances from binding to the same port.

The default is FALSE; multiple module instances can bind to the same port.

This directive is only supported on Windows.

ReuseAddr

Set this directive to TRUE to allow the module instance to bind to a port that is already in use.

The default is TRUE; multiple module instances can listen on the same port and process data simultaneously.

ReusePort

Set this directive to TRUE to allow multiple module instances to listen on the same port. Each instance runs in a separate thread, allowing NXLog Agent to process incoming logs simultaneously.

The default is FALSE; multiple module instances cannot bind to the same port.

This directive is not supported on Windows.

TCP connections are kept alive by keep-alive packets. This feature is enabled by default and cannot be disabled.

Fields

The following fields are created by im_tcp.

$raw_event (type: string): The received string.
$MessageSourceAddress (type: ipaddr): The IP address of the remote host.

Examples

Example 1. Using the im_tcp module

With this configuration, NXLog Agent listens for TCP connections on port 1514 and writes the received log messages to a file.

nxlog.conf

<Input tcp>
    Module      im_tcp
    ListenAddr  0.0.0.0:1514
</Input>

<Output file>
    Module  om_file
    File    "tmp/output"
</Output>

<Route tcp_to_file>
    Path    tcp => file
</Route>

Example 2. Reusing a single port by multiple module instances

The configuration below provides two im_tcp module instances to reuse port 1514 via the ReusePort directive. Received messages are written to the /tmp/output file.

nxlog.conf

<Input tcp_one>
    Module      im_tcp
    ListenAddr  192.168.31.11:1514
    ReusePort   TRUE
</Input>

<Input tcp_two>
    Module      im_tcp
    ListenAddr  192.168.31.11:1514
    ReusePort   TRUE
</Input>