{"id":87,"date":"2015-01-09T09:14:38","date_gmt":"2015-01-09T09:14:38","guid":{"rendered":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=87"},"modified":"2017-12-08T10:55:48","modified_gmt":"2017-12-08T10:55:48","slug":"the-textfile-module","status":"publish","type":"page","link":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=87","title":{"rendered":"The textfile module"},"content":{"rendered":"

The textfile<\/code> module was originally designed to allow Orchids to read data from a text file, and split it into lines.\u00a0 It can now also read from Unix pipes and Unix (AF_UNIX<\/code>) TCP sockets.<\/p>\n

The textfile<\/code> module is\u00a0 an input module<\/a>, meaning that its purpose is to read data from some sources, and convert it to Orchids events.\u00a0 The sources\u00a0 should be declared in the orchids-inputs.conf<\/code><\/a> file, by directives such as:<\/p>\n

INPUT textfile \/var\/log\/messages<\/pre>\n
Admissible sources are regular files, Posix pipes and Unix (AF_UNIX<\/code>) TCP sockets (SOCK_STREAM<\/code>).\u00a0 The latter are needed to interact with auditd<\/code><\/a>, for example.<\/p>\n
Internet (AF_INET<\/code>) sockets are not handled, and should be dealt with using the udp<\/code><\/a> module.\u00a0 Unix UDP sockets (SOCK_DGRAM<\/code>) should be dealt with using the sockunix<\/code><\/a> module.<\/p>\n
The textfile<\/code> module reads from these sources and produces Orchids events, one per text line.\u00a0 The contents of each line will then be found in the .textfile.line<\/code> field of the event.\u00a0 The name of the source, as given in the orchids-inputs.conf<\/code><\/a> file, will be in .textfile.file<\/code>.<\/p>\n
Configuration options<\/h3>\n
<module textfile><\/code><\/p>\n