{"id":396,"date":"2015-05-11T05:45:14","date_gmt":"2015-05-11T05:45:14","guid":{"rendered":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=396"},"modified":"2017-12-08T10:49:36","modified_gmt":"2017-12-08T10:49:36","slug":"the-binfile-module","status":"publish","type":"page","link":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=396","title":{"rendered":"The binfile module"},"content":{"rendered":"

The binfile<\/code> module is very similar to the textfile<\/code>\u00a0module<\/a>. \u00a0It reads data from a binary file instead of a text file, and returns blocks of raw data instead of text lines. \u00a0It can read data from text files,\u00a0\u00a0from Unix pipes and from Unix (AF_UNIX<\/code>) TCP sockets.<\/p>\n

The binfile<\/code> module is\u00a0 an input module<\/a>, meaning that its purpose is to read data from some sources, and convert it to Orchids events.\u00a0 The sources\u00a0 should be declared in the orchids-inputs.conf<\/code><\/a> file, by directives such as:<\/p>\n

INPUT binfile \/var\/log\/bsm\/current<\/pre>\n
Admissible sources are regular files, Posix pipes and Unix (AF_UNIX<\/code>) TCP sockets (SOCK_STREAM<\/code>).<\/p>\n
Internet (AF_INET<\/code>) sockets are not handled, and should be dealt with using the udp<\/code><\/a> module.\u00a0 Unix UDP sockets (SOCK_DGRAM<\/code>) should be dealt with using the sockunix<\/code><\/a> module.<\/p>\n
The binfile<\/code> module reads from these sources and produces Orchids events, one per block of data.\u00a0 The size of each block is currently hard-coded (to 1024 bytes). \u00a0Actual blocks may be smaller. \u00a0The contents of each block will then be found in the .binfile.block<\/code>\u00a0field of the event.\u00a0 The name of the source, as given in the orchids-inputs.conf<\/code><\/a> file, will be in .binfile.file<\/code>.<\/p>\n
Configuration options<\/h3>\n
<module binfile><\/code><\/p>\n