Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 28 additions & 4 deletions nmsg-relay.1
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,11 @@ nmsg-relay \- Relay NMSG data from local datagram sockets to Farsight Security S
.br
.B " -input (\fIaddr/port\fB|\fIaddr/lowport..highport\fB)"
.br
.B " [ -stats_interval \fIduration\fB] [--flush \fIduration\fB ]
.B " [ -stats_interval \fIduration\fB] [--flush \fIduration\fB ]"
.br
.B " [ -heartbeat \fIduration\fB] [--retry \fIduration\fB ]
.B " [ -heartbeat \fIduration\fB] [--retry \fIduration\fB ]"
.br
.B " [ -message_type \fIvname:mtype\fB ]"
.br
.B " wss://\fIserver\fB/[session/\fIsession-name\fB]"
.br
Expand Down Expand Up @@ -57,7 +59,7 @@ Provides the SIE channel on which the data will be published.

.TP
.B -config \fIfile\fB
Reads configuration from \fIfile\fB
Reads configuration from \fIfile\fB.

.TP
.B -flush \fIduration\fB
Expand All @@ -81,6 +83,17 @@ open and listen on a single port. If specified with \fIaddr/lowport..highport\fR
form, \fBnmsg-relay\fR will listen for NMSG data on \fIaddr\fR using a
contiguous range of ports between \fIlowport\fR and \fIhighport\fR, inclusive.

.TP
.B -message_type \fIvname:mtype\fB
Only relay NMSG data identified with the NMSG vendor ID
and NMSG message type
\fIvname:mtype\fR.
This message type includes the vendor ID and the message type
separated with a colon, e.g.
\fIbase:dnstap\fR.
This option may be used multiple times for multiple message types.
By default, all message types may be collected.

.TP
.B -retry \fIduration\fB
Specifies the time \fBnmsg-relay\fR waits to re-establish a connection after
Expand Down Expand Up @@ -125,6 +138,11 @@ corresponds to \fB-heartbeat\fR option
.B NMSG_RELAY_INPUT
corresponds to \fB-input\fR option

.TP
.B NMSG_RELAY_MESSAGE_TYPES
corresponds to \fB-message_type\fR option.
It may contain multiple message types, separated by commas.

.TP
.B NMSG_RELAY_RETRY
corresponds to \fB-retry\fR option
Expand All @@ -133,6 +151,7 @@ corresponds to \fB-retry\fR option
.B NMSG_RELAY_STATS_INTERVAL
corresponds to \fB-stats_interval\fR option

.PP
In addition, the \fBNMSG_RELAY_CONFIG\fR environment variable, if set,
is interpreted as a path to a configuration file in YAML format.
The \fBNMSG_RELAY_SERVERS\fR variable may contain a space-separated list of
Expand All @@ -146,7 +165,7 @@ reads the config file as a YAML dictionary. The keys in this dictionary
include:

.TP
.B apikey
.B api_key
corresponds to \fB-apikey\fR option

.TP
Expand All @@ -165,6 +184,11 @@ corresponds to \fB-heartbeat\fR option
.B input
corresponds to \fB-input\fR option

.TP
.B message_types
corresponds to \fB-message_type\fR option.
This key takes a list of strings to contain multiple message types.

.TP
.B retry
corresponds to \fB-retry\fR option
Expand Down