<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"></meta><title>ListenSyslog</title><link rel="stylesheet" href="../../../../../css/component-usage.css" type="text/css"></link></head><script type="text/javascript">window.onload = function(){if(self==top) { document.getElementById('nameHeader').style.display = "inherit"; } }</script><body><h1 id="nameHeader" style="display: none;">ListenSyslog</h1><h2>Description: </h2><p>Listens for Syslog messages being sent to a given port over TCP or UDP. Incoming messages are checked against regular expressions for RFC5424 and RFC3164 formatted messages. The format of each message is: (&lt;PRIORITY&gt;)(VERSION )(TIMESTAMP) (HOSTNAME) (BODY) where version is optional. The timestamp can be an RFC5424 timestamp with a format of "yyyy-MM-dd'T'HH:mm:ss.SZ" or "yyyy-MM-dd'T'HH:mm:ss.S+hh:mm", or it can be an RFC3164 timestamp with a format of "MMM d HH:mm:ss". If an incoming messages matches one of these patterns, the message will be parsed and the individual pieces will be placed in FlowFile attributes, with the original message in the content of the FlowFile. If an incoming message does not match one of these patterns it will not be parsed and the syslog.valid attribute will be set to false with the original message in the content of the FlowFile. Valid messages will be transferred on the success relationship, and invalid messages will be transferred on the invalid relationship.</p><h3>Tags: </h3><p>syslog, listen, udp, tcp, logs</p><h3>Properties: </h3><p>In the list below, the names of required properties appear in <strong>bold</strong>. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property supports the <a href="../../../../../html/expression-language-guide.html">NiFi Expression Language</a>.</p><table id="properties"><tr><th>Display Name</th><th>API Name</th><th>Default Value</th><th>Allowable Values</th><th>Description</th></tr><tr><td id="name"><strong>Protocol</strong></td><td>Protocol</td><td id="default-value">UDP</td><td id="allowable-values"><ul><li>TCP</li><li>UDP</li></ul></td><td id="description">The protocol for Syslog communication.</td></tr><tr><td id="name"><strong>Port</strong></td><td>Port</td><td></td><td id="allowable-values"></td><td id="description">The port for Syslog communication. Note that Expression language is not evaluated per FlowFile.<br/><strong>Supports Expression Language: true (will be evaluated using variable registry only)</strong></td></tr><tr><td id="name">Local Network Interface</td><td>Local Network Interface</td><td></td><td id="allowable-values"></td><td id="description">The name of a local network interface to be used to restrict listening to a specific LAN.<br/><strong>Supports Expression Language: true (will be evaluated using variable registry only)</strong></td></tr><tr><td id="name"><strong>Socket Keep Alive</strong></td><td>socket-keep-alive</td><td id="default-value">false</td><td id="allowable-values"><ul><li>true</li><li>false</li></ul></td><td id="description">Whether or not to have TCP socket keep alive turned on. Timing details depend on operating system properties.<br/><br/><strong>This Property is only considered if </strong><strong>the [Protocol] Property has a value of "TCP".</strong></td></tr><tr><td id="name">SSL Context Service</td><td>SSL Context Service</td><td></td><td id="allowable-values"><strong>Controller Service API: </strong><br/>RestrictedSSLContextService<br/><strong>Implementation: </strong><a href="../../../nifi-ssl-context-service-nar/1.19.1/org.apache.nifi.ssl.StandardRestrictedSSLContextService/index.html">StandardRestrictedSSLContextService</a></td><td id="description">The Controller Service to use in order to obtain an SSL Context. If this property is set, syslog messages will be received over a secure connection.<br/><br/><strong>This Property is only considered if </strong><strong>the [Protocol] Property has a value of "TCP".</strong></td></tr><tr><td id="name">Client Auth</td><td>Client Auth</td><td id="default-value">REQUIRED</td><td id="allowable-values"><ul><li>WANT</li><li>REQUIRED</li><li>NONE</li></ul></td><td id="description">The client authentication policy to use for the SSL Context. Only used if an SSL Context Service is provided.<br/><br/><strong>This Property is only considered if </strong><strong>the [SSL Context Service] Property has a value specified.</strong></td></tr><tr><td id="name"><strong>Receive Buffer Size</strong></td><td>Receive Buffer Size</td><td id="default-value">65507 B</td><td id="allowable-values"></td><td id="description">The size of each buffer used to receive Syslog messages. Adjust this value appropriately based on the expected size of the incoming Syslog messages. When UDP is selected each buffer will hold one Syslog message. When TCP is selected messages are read from an incoming connection until the buffer is full, or the connection is closed. </td></tr><tr><td id="name"><strong>Max Size of Message Queue</strong></td><td>Max Size of Message Queue</td><td id="default-value">10000</td><td id="allowable-values"></td><td id="description">The maximum size of the internal queue used to buffer messages being transferred from the underlying channel to the processor. Setting this value higher allows more messages to be buffered in memory during surges of incoming messages, but increases the total memory used by the processor.</td></tr><tr><td id="name"><strong>Max Size of Socket Buffer</strong></td><td>Max Size of Socket Buffer</td><td id="default-value">1 MB</td><td id="allowable-values"></td><td id="description">The maximum size of the socket buffer that should be used. This is a suggestion to the Operating System to indicate how big the socket buffer should be. If this value is set too low, the buffer may fill up before the data can be read, and incoming data will be dropped.<br/><br/><strong>This Property is only considered if </strong><strong>the [Protocol] Property has a value of "TCP".</strong></td></tr><tr><td id="name"><strong>Max Number of TCP Connections</strong></td><td>Max Number of TCP Connections</td><td id="default-value">2</td><td id="allowable-values"></td><td id="description">The maximum number of concurrent connections to accept Syslog messages in TCP mode.<br/><br/><strong>This Property is only considered if </strong><strong>the [Protocol] Property has a value of "TCP".</strong></td></tr><tr><td id="name"><strong>Max Batch Size</strong></td><td>Max Batch Size</td><td id="default-value">1</td><td id="allowable-values"></td><td id="description">The maximum number of Syslog events to add to a single FlowFile. If multiple events are available, they will be concatenated along with the &lt;Message Delimiter&gt; up to this configured maximum number of messages</td></tr><tr><td id="name"><strong>Message Delimiter</strong></td><td>Message Delimiter</td><td id="default-value">\n</td><td id="allowable-values"></td><td id="description">Specifies the delimiter to place between Syslog messages when multiple messages are bundled together (see &lt;Max Batch Size&gt; property).</td></tr><tr><td id="name"><strong>Parse Messages</strong></td><td>Parse Messages</td><td id="default-value">true</td><td id="allowable-values"><ul><li>true</li><li>false</li></ul></td><td id="description">Indicates if the processor should parse the Syslog messages. If set to false, each outgoing FlowFile will only contain the sender, protocol, and port, and no additional attributes.</td></tr><tr><td id="name"><strong>Character Set</strong></td><td>Character Set</td><td id="default-value">UTF-8</td><td id="allowable-values"></td><td id="description">Specifies the character set of the Syslog messages. Note that Expression language is not evaluated per FlowFile.<br/><strong>Supports Expression Language: true (will be evaluated using variable registry only)</strong></td></tr></table><h3>Relationships: </h3><table id="relationships"><tr><th>Name</th><th>Description</th></tr><tr><td>success</td><td>Syslog messages that match one of the expected formats will be sent out this relationship as a FlowFile per message.</td></tr><tr><td>invalid</td><td>Syslog messages that do not match one of the expected formats will be sent out this relationship as a FlowFile per message.</td></tr></table><h3>Reads Attributes: </h3>None specified.<h3>Writes Attributes: </h3><table id="writes-attributes"><tr><th>Name</th><th>Description</th></tr><tr><td>syslog.priority</td><td>The priority of the Syslog message.</td></tr><tr><td>syslog.severity</td><td>The severity of the Syslog message derived from the priority.</td></tr><tr><td>syslog.facility</td><td>The facility of the Syslog message derived from the priority.</td></tr><tr><td>syslog.version</td><td>The optional version from the Syslog message.</td></tr><tr><td>syslog.timestamp</td><td>The timestamp of the Syslog message.</td></tr><tr><td>syslog.hostname</td><td>The hostname or IP address of the Syslog message.</td></tr><tr><td>syslog.sender</td><td>The hostname of the Syslog server that sent the message.</td></tr><tr><td>syslog.body</td><td>The body of the Syslog message, everything after the hostname.</td></tr><tr><td>syslog.valid</td><td>An indicator of whether this message matched the expected formats. If this value is false, the other attributes will be empty and only the original message will be available in the content.</td></tr><tr><td>syslog.protocol</td><td>The protocol over which the Syslog message was received.</td></tr><tr><td>syslog.port</td><td>The port over which the Syslog message was received.</td></tr><tr><td>mime.type</td><td>The mime.type of the FlowFile which will be text/plain for Syslog messages.</td></tr></table><h3>State management: </h3>This component does not store state.<h3>Restricted: </h3>This component is not restricted.<h3>Input requirement: </h3>This component does not allow an incoming relationship.<h3>System Resource Considerations:</h3>None specified.<h3>See Also:</h3><p><a href="../org.apache.nifi.processors.standard.PutSyslog/index.html">PutSyslog</a>, <a href="../org.apache.nifi.processors.standard.ParseSyslog/index.html">ParseSyslog</a></p></body></html>