AllowedSender

Restricts TCP syslog senders by source address or hostname.

This parameter applies to imtcp: TCP Syslog Input Module.

Name:

AllowedSender

Scope:

module, input

Type:

array

Default:

module=none, input=module parameter

Required?:

no

Introduced:

8.2608.0

Description

Sets source-address ACL entries for TCP syslog inputs. Entries use the same address syntax as the legacy $AllowedSender directive, for example 127.0.0.1/16, 192.0.2.0/24, [::1]/128, *.example.net, or somehost.example.com.

A module-level AllowedSender list is used as the default for imtcp inputs. An input-level AllowedSender list replaces the module-level list for that input. If neither the module nor the input configures this parameter, all senders are accepted unless legacy $AllowedSender directives are present. If AllowedSender is configured, the array must contain at least one entry. An empty input array cannot be used to clear a module-level default. Configure explicit per-input sender lists, or omit the module-level default if some inputs must remain unrestricted. Do not mix legacy $AllowedSender and modern AllowedSender in new configurations.

AllowedSender checks the remote socket address or reverse-DNS hostname. It is separate from PermittedPeer, which checks TLS peer identity and only applies to authenticated TLS modes. Firewall rules remain the preferred first line of defense.

Module usage

module(load="imtcp" allowedSender=["192.0.2.0/24"])

Input usage

input(type="imtcp" port="514" allowedSender=["127.0.0.1/16", "[::1]/128"])

YAML usage

modules:
  - load: imtcp
    allowedSender: ["192.0.2.0/24"]
inputs:
  - type: imtcp
    port: "514"
    allowedSender: ["127.0.0.1/16"]

See also

See also imtcp: TCP Syslog Input Module and $AllowedSender.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2026 Rainer Gerhards and others. Licensed under the Apache License 2.0.