NXLog User Guide
- OS Support
- Enterprise Edition Reference Manual
- 143. Man Pages
- 144. Configuration
- 145. Language
- 146. Extension Modules
- 147. Input Modules
- 147.1. Process accounting (im_acct)
- 147.2. AIX auditing (im_aixaudit)
- 147.3. Azure (im_azure)
- 147.4. Batched compression (im_batchcompress)
- 147.5. Basic Security Module Auditing (im_bsm)
- 147.6. Check Point OPSEC LEA (im_checkpoint)
- 147.7. DBI (im_dbi)
- 147.8. Event Tracing for Windows (im_etw)
- 147.9. External programs (im_exec)
- 147.10. File (im_file)
- 147.11. File integrity monitoring (im_fim)
- 147.12. Go (im_go)
- 147.13. HTTP(s) (im_http)
- 147.14. Internal (im_internal)
- 147.15. Java (im_java)
- 147.16. Kafka (im_kafka)
- 147.17. Kernel (im_kernel)
- 147.18. Linux Audit System (im_linuxaudit)
- 147.19. macOS Endpoint Security (im_maces)
- 147.20. macOS ULS (im_maculs)
- 147.21. Mark (im_mark)
- 147.22. Event Logging for Windows XP/2000/2003 (im_mseventlog)
- 147.23. Event log for Windows 2008/Vista and later (im_msvistalog)
- 147.24. Null (im_null)
- 147.25. ODBC (im_odbc)
- 147.26. Packet capture (im_pcap)
- 147.27. Perl (im_perl)
- 147.28. Named pipes (im_pipe)
- 147.29. Python (im_python)
- 147.30. Redis (im_redis)
- 147.31. Windows Registry Monitoring (im_regmon)
- 147.32. Ruby (im_ruby)
- 147.33. TLS/SSL (im_ssl)
- 147.34. Systemd (im_systemd)
- 147.35. TCP (im_tcp)
- 147.36. Test Generator (im_testgen)
- 147.37. UDP (im_udp)
- 147.38. Unix domain sockets (im_uds)
- 147.39. Windows Performance Counters (im_winperfcount)
- 147.40. Windows Event Collector (im_wseventing)
- 147.41. ZeroMQ (im_zmq)
- 148. Processor Modules
- 149. Output Modules
- NXLog Manager
- NXLog Add-Ons
This module accepts UDP datagrams on the configured address and port. UDP is the transport protocol of the legacy BSD Syslog as described in RFC 3164, so this module can be particularly useful to receive such messages from older devices which do not support other transports.
|To examine the supported platforms, see the list of installer packages in the Available Modules chapter.|
|UDP is an unreliable transport protocol, and does not guarantee delivery. Messages may not be received or may be truncated. It is recommended to use the TCP or SSL transport modules instead, if possible.|
To reduce the likelihood of message loss, consider:
|This module provides no access control. Firewall rules can be used to drop log events from certain hosts.|
The im_udp module accepts the following directives in addition to the common module directives.
The module accepts connections on the IP address or hostname and port defined here. The default address is
localhostand the default port is 514. The port number can be defined by appending it at the end of the hostname or IP address using a colon as a separator (
host:port). IPv6 addresses must be enclosed in square brackets (
[host]:port). The port section of this directive and the Port directive are mutually exclusive. In case both are defined, the port number defined here takes precedence over a port defined in the Port directive. In case none of them is defined, the default port 514 is used.
To listen on multiple addresses or ports in a single module instance, this directive can be repeated multiple times. Both IPv4 and IPv6 addresses are supported. If a DNS name is used, the number of addresses or cnames should be kept below 16 to avoid potential issues caused by DNS response size limits.
|Formerly called Host, this directive is now ListenAddr. Host will become deprecated from NXLog EE 6.0.|
When a hostname is used as the
For client applications that don’t support IPv6, to avoid the behavior
described above the
Alternatively, the server-side system may be configured to prioritize IPv4
addresses for the hostname specified by the
For more information see the Microsoft documentation on Configuring IPv6 in Windows for advanced users.
This limitation will be addressed in a future release by making listening modules bind to all available IPv4/IPv6 addresses that a hostname resolves to.
The module will listen for incoming connections on this port number. The default is port 514.
|The Port directive will become deprecated from NXLog EE 6.0. After that, the port can only be defined in the ListenAddr directive.|
This optional boolean directive enables synchronous listening on the same port by multiple module instances. Each module instance runs in its own thread, allowing NXLog to process incoming data simultaneously to take better advantage of multiprocessor systems. The default value is FALSE.
To enable synchronous listening, the configuration file should contain multiple im_udp module instances listening on the same port and the ReusePort directive set to TRUE, see the Examples section.
This optional directive sets the socket buffer size (SO_RCVBUF) to the value specified. If not set, the operating system defaults are used. If UDP packet loss is occurring at the kernel level, setting this to a high value (such as
150000000) may help. On Windows systems the default socket buffer size is extremely low, and using this option is highly recommended.
This boolean directive specifies that the
recvmmsg()system call should be used, if available, to receive multiple messages per call to improve performance. The default is TRUE.
The following fields are used by im_udp.
The received string.
The IP address of the remote host.
Pre-v5 syntax examples are included, they will become invalid with NXLog EE 6.0.
This configuration accepts log messages via UDP and writes them to a file.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 <Input udp> Module im_udp ListenAddr 192.168.1.1:514 </Input> # Using the syntax prior to NXLog EE 5, # where the port is defined in a separate directive. #<Input udp> # Module im_udp # Host 192.168.1.1 # Port 514 #</Input> <Output file> Module om_file File "tmp/output" </Output> <Route udp_to_file> Path udp => file </Route>
The configuration below provides two im_udp module instances to reuse
port 514 via the ReusePort directive.
Received messages are written to the
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 <Input udp_one> Module im_udp ListenAddr 192.168.1.1:514 ReusePort TRUE </Input> <Input udp_two> Module im_udp ListenAddr 192.168.1.1:514 ReusePort TRUE </Input> # Using the syntax prior to NXLog EE 5, # where the port is defined in a separate directive. #<Input udp_one> # Module im_udp # Host 192.168.1.1 # Port 514 # ReusePort TRUE #</Input> # #<Input udp_two> # Module im_udp # Host 192.168.1.1 # Port 514 # ReusePort TRUE #</Input> <Output file> Module om_file File "tmp/output" </Output> <Route udp_to_file> Path udp_one, udp_two => file </Route>