compression.mode

Enables stream decompression for TCP streams sent by omfwd with compression.mode="stream:always".

This parameter applies to imtcp: TCP Syslog Input Module.

Name:

compression.mode

Scope:

input/module

Type:

word

Default:

input=none

Required?:

no

Introduced:

8.2606.0

Description

compression.mode selects whether imtcp decompresses the received TCP stream before parsing syslog frames.

Accepted values are:

  • none: do not attempt stream decompression.

  • stream:always: treat the full TCP byte stream as compressed data from omfwd configured with compression.mode="stream:always".

The sender and receiver must use the same compression.driver. The default driver is zlib. For zstd, both sides must be built with libzstd support and configured with compression.driver="zstd".

This is rsyslog stream compression, not TLS-native compression. It is intended for trusted company VPNs and internal WAN/LAN links where the endpoints are controlled together. Compression can create side channels through compressed sizes and timing, so do not enable it for sensitive traffic unless that risk is acceptable. Use TLS separately when confidentiality or peer authentication is required.

imtcp supports stream:always decompression only. It does not receive omfwd sender-side single compression mode.

Decompressed output is bounded by compression.maxExpansionRatio and compression.maxDecompressedBytesPerReceive. If either guard is exceeded, imtcp logs the stream as invalid and closes the session.

Input usage

input(type="imtcp" port="514" compression.mode="stream:always")

See also

See also compression.driver, compression.maxExpansionRatio, compression.maxDecompressedBytesPerReceive, and imtcp: TCP Syslog Input Module.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2026 Rainer Gerhards and others. Licensed under the Apache License 2.0.