- Introduction
- Deployment
- Configuration
- OS Support
- Integration
- Troubleshooting
- Enterprise Edition Reference Manual
- 127. Man Pages
- 128. Configuration
- 129. Language
- 130. Extension Modules
- 131. Input Modules
- 131.1. Process Accounting (im_acct)
- 131.2. AIX Auditing (im_aixaudit)
- 131.3. Azure (im_azure)
- 131.4. Batched Compression (im_batchcompress)
- 131.5. Basic Security Module Auditing (im_bsm)
- 131.6. Check Point OPSEC LEA (im_checkpoint)
- 131.7. DBI (im_dbi)
- 131.8. Event Tracing for Windows (im_etw)
- 131.9. External Programs (im_exec)
- 131.10. Files (im_file)
- 131.11. File Integrity Monitoring (im_fim)
- 131.12. Go (im_go)
- 131.13. HTTP(s) (im_http)
- 131.14. Internal (im_internal)
- 131.15. Java (im_java)
- 131.16. Kafka (im_kafka)
- 131.17. Kernel (im_kernel)
- 131.18. Linux Audit System (im_linuxaudit)
- 131.19. macOS ULS (im_maculs)
- 131.20. Mark (im_mark)
- 131.21. EventLog for Windows XP/2000/2003 (im_mseventlog)
- 131.22. EventLog for Windows 2008/Vista and Later (im_msvistalog)
- 131.23. Null (im_null)
- 131.24. ODBC (im_odbc)
- 131.25. Packet Capture (im_pcap)
- 131.26. Perl (im_perl)
- 131.27. Named Pipes (im_pipe)
- 131.28. Python (im_python)
- 131.29. Redis (im_redis)
- 131.30. Windows Registry Monitoring (im_regmon)
- 131.31. Ruby (im_ruby)
- 131.32. TLS/SSL (im_ssl)
- 131.33. Systemd (im_systemd)
- 131.34. TCP (im_tcp)
- 131.35. Test Generator (im_testgen)
- 131.36. UDP (im_udp)
- 131.37. Unix Domain Sockets (im_uds)
- 131.38. Windows Performance Counters (im_winperfcount)
- 131.39. Windows Event Collector (im_wseventing)
- 131.40. ZeroMQ (im_zmq)
- 132. Processor Modules
- 133. Output Modules
- NXLog Manager
- NXLog Add-Ons
131.34. TCP (im_tcp)
This module accepts TCP connections on the configured address and port. It can handle multiple simultaneous connections. The TCP transfer protocol provides more reliable log transmission than UDP. If security is a concern, consider using the im_ssl module instead.
Note
|
To examine the supported platforms, see the list of installer packages in the Available Modules chapter. |
Note
|
This module provides no access control. Firewall rules can be used to deny connections from certain hosts. |
131.34.1. Configuration
The im_tcp module accepts the following directives in addition to the common module directives.
- ListenAddr
-
The module will accept connections on this IP address or DNS hostname. For security, the default listen address is
localhost
(the localhost loopback address is not accessible from the outside). To receive logs from remote hosts, the address specified here must be accessible. The any address0.0.0.0
is commonly used here. The port number can be defined by appending it at the end of the hostname or IP address using a colon as a separator (host:port
). The port section of this directive and the Port directive are mutually exclusive. In case both is defined, the port number defined here takes precedence over a port defined in the Port directive. In case none of them is defined, the default port 514 is used.
Important
|
Formerly called Host, this directive is now ListenAddr. Host for incoming traffic will become deprecated from NXLog EE 6.0. |
Note
|
When a hostname is used as the |
Note
|
When the For client applications that don’t support IPv6, to avoid the behavior
described above the Alternatively, the server-side system may be configured to prioritize IPv4
addresses for the hostname specified by the
For more information see the Microsoft documentation on Configuring IPv6 in Windows for advanced users. This limitation will be addressed in a future release by making listening modules bind to all available IPv4/IPv6 addresses that a hostname resolves to. |
- Port
-
The module will listen for incoming connections on this port number. The default port is 514 if this directive is not specified.
Important
|
The Port directive will become deprecated from NXLog EE 6.0. After that, the port can only be defined in the ListenAddr directive. |
- ReusePort
-
This optional boolean directive enables synchronous listening on the same port by multiple module instances. Each module instance runs in its own thread, allowing NXLog to process incoming data simultaneously to take better advantage of multiprocessor systems. The default value is FALSE.
To enable synchronous listening, the configuration file should contain multiple im_tcp module instances listening on the same port and the ReusePort directive set to TRUE, see the Examples section.
131.34.2. Fields
The following fields are used by im_tcp.
$raw_event
(type: string)-
The received string.
$MessageSourceAddress
(type: string)-
The IP address of the remote host.
131.34.3. Examples
Pre-v5 syntax examples are included, they will become invalid with NXLog EE 6.0.
With this configuration, NXLog listens for TCP connections on port 1514 and writes the received log messages to a file.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
<Input tcp>
Module im_tcp
ListenAddr 0.0.0.0:1514
</Input>
# Using the syntax prior to NXLog EE 5,
# where the port is defined in a separate directive.
#<Input tcp>
# Module im_tcp
# Host 0.0.0.0
# Port 1514
#</Input>
<Output file>
Module om_file
File "tmp/output"
</Output>
<Route tcp_to_file>
Path tcp => file
</Route>
The configuration below provides two im_tcp module instances to reuse
port 1514 via the ReusePort directive.
Received messages are written to the /tmp/output
file.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<Input tcp_one>
Module im_tcp
ListenAddr 192.168.31.11:1514
ReusePort TRUE
</Input>
<Input tcp_two>
Module im_tcp
ListenAddr 192.168.31.11:1514
ReusePort TRUE
</Input>
# Using the syntax prior to NXLog EE 5,
# where the port is defined in a separate directive.
#<Input tcp_one>
# Module im_tcp
# Host 192.168.31.11
# Port 1514
# ReusePort TRUE
#/Input>
#
#<Input tcp_two>
# Module im_tcp
# Host 192.168.31.11
# Port 1514
# ReusePort TRUE
#</Input>