Interface eth1
IgnoreSelected true
</Plugin>
-
+
=over 4
=item B<Interface> I<interface_name>
matches.
=head2 Plugin C<procevent>
-
+
The I<procevent> plugin monitors when processes start (EXEC) and stop (EXIT).
-
+
B<Synopsis:>
-
+
<Plugin procevent>
BufferLength 10
Process "name"
ProcessRegex "regex"
</Plugin>
-
+
B<Options:>
-
+
=over 4
-
+
=item B<BufferLength> I<length>
-
+
Maximum number of process events that can be stored in plugin's ring buffer.
By default, this is set to 10. Once an event has been read, its location
becomes available for storing a new event.
-
+
=item B<Process> I<name>
-
+
Enumerate a process name to monitor. All processes that match this exact
name will be monitored for EXECs and EXITs.
=item B<ProcessRegex> I<regex>
-
+
Enumerate a process pattern to monitor. All processes that match this
regular expression will be monitored for EXECs and EXITs.
-
+
=back
=head2 Plugin C<protocols>
=back
=head2 Plugin C<sysevent>
-
+
The I<sysevent> plugin monitors rsyslog messages.
-
+
B<Synopsis:>
-
+
<Plugin sysevent>
Listen "192.168.0.2" "6666"
BufferSize 1024
are meant to demonstration the proper remote logging and JSON format syntax.
B<Options:>
-
+
=over 4
-
+
=item B<Listen> I<host> I<port>
-
+
Listen on this IP on this port for incoming rsyslog messages.
=item B<BufferSize> I<length>
-
+
Maximum allowed size for incoming rsyslog messages. Messages that exceed
this number will be truncated to this size. Default is 4096 bytes.
=item B<BufferLength> I<length>
-
+
Maximum number of rsyslog events that can be stored in plugin's ring buffer.
By default, this is set to 10. Once an event has been read, its location
becomes available for storing a new event.
=item B<RegexFilter> I<regex>
-
+
Enumerate a regex filter to apply to all incoming rsyslog messages. If a
message matches this filter, it will be published.
-
+
=back
=head2 Plugin C<syslog>