imfifo: Named Pipe Input Module¶

This module provides the ability to read log messages line-by-line from named pipes (FIFOs) on the local filesystem.

Module Name:	imfifo
Author/Maintainer:	Rainer Gerhards <rgerhards@adiscon.com>
Introduced:	8.2606.0

Purpose¶

The imfifo module allows rsyslog to monitor local POSIX named pipes (FIFOs). It reads incoming log messages line-by-line and submits them to rsyslog queues for processing.

This module is designed for modern dynamic configuration and supports multiple input instances. This allows you to monitor different named pipes concurrently, each with different tag, ruleset, facility, or severity configurations.

Main Features¶

Line-by-line Reading: Messages are read from the named pipe and split on newline (\n) boundaries.
O_RDWR Opening Technique: To prevent rsyslog from blocking indefinitely during startup when no writers are yet connected to the pipe, and to avoid spinning on EOF when a writer disconnects, the module opens named pipes in O_RDWR mode.
Ruleset Binding: Each pipe instance can be bound to a specific ruleset for isolated log routing and processing.
Clean Shutdown: Utilizes non-blocking poll() loops with a short timeout to ensure rsyslog shuts down cleanly and instantly when requested.

Configuration¶

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

Input Parameters¶

Parameter	Summary
file	Specifies the absolute filesystem path of the named pipe (FIFO) to read log messages from.
tag	Specifies the syslog tag to apply to messages read from this named pipe (FIFO).
facility	Specifies the syslog facility to apply to messages read from this named pipe (FIFO).
severity	Specifies the syslog severity to apply to messages read from this named pipe (FIFO).
ruleset	Binds this imfifo input instance to a specific ruleset.

Configuration Examples¶

The following example loads the imfifo module and configures two separate input instances to read from different local named pipes.

module(load="imfifo")

# Monitor custom application pipe
input(type="imfifo"
      file="/var/run/app_log.pipe"
      tag="app-pipe:"
      severity="info"
      facility="local3")

# Monitor system events pipe
input(type="imfifo"
      file="/var/run/sys_events.pipe"
      tag="sys-events:")

Notes¶

Named Pipe Creation: The target named pipes must be pre-created on the filesystem using mkfifo before rsyslog starts. For example:
```
mkfifo /var/run/app_log.pipe
chmod 600 /var/run/app_log.pipe
```
Security & Posture: To maintain a secure environment, ensure that the permissions on the named pipes are restricted (e.g., owned by the user running rsyslog and set to mode 600 or 620). Do not allow untrusted users to write to pipes monitored by rsyslog.

imfifo: Named Pipe Input Module¶

Purpose¶

Main Features¶

Configuration¶

Input Parameters¶

Configuration Examples¶

Notes¶

See also¶