[OpenNMS/opennms] 7c2242: NMS-6400: Add syslog TCP settings to the configura...

  Branch: refs/heads/mm/NMS-6400-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: 7c22422e32067052ab4902f5584eda8ddc20da77
      https://github.com/OpenNMS/opennms/commit/7c22422e32067052ab4902f5584eda8ddc20da77
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogConfigBean.java
    M opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/Configuration.java
    A opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpClientAuth.java
    A opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpConfig.java
    A opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpFraming.java
    M opennms-config-model/src/main/resources/xsds/syslog.xsd
    A opennms-config-model/src/test/java/org/opennms/netmgt/config/syslogd/SyslogTcpConfigTest.java
    M opennms-config-model/src/test/java/org/opennms/netmgt/config/syslogd/SyslogdConfigurationTest.java
    M opennms-config/src/main/java/org/opennms/netmgt/config/SyslogdConfig.java
    M opennms-config/src/main/java/org/opennms/netmgt/config/SyslogdConfigFactory.java

  Log Message:
  -----------
  NMS-6400: Add syslog TCP settings to the configuration model

Eleven optional attributes on the syslogd configuration, all of them off by
default: the listen port and address, the RFC 6587 framing, message and
connection limits, an idle timeout, and the RFC 5425 TLS material. Leaving
syslog-tcp-port unset gives the UDP-only behaviour installs have today.

SyslogTcpConfig is the shared shape both SyslogdConfig implementations expose, so
the core reaches it through the JAXB model and a Minion through a bean the
blueprint populates. Framing and client authentication are strings there, parsed
on the way out, because the Minion has no schema to reject a typo for it.


  Commit: 5901c9de94bfe1e8379e2404e9ad9688efbe5ed1
      https://github.com/OpenNMS/opennms/commit/5901c9de94bfe1e8379e2404e9ad9688efbe5ed1
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M features/events/syslog/pom.xml
    A features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpExceptionHandler.java
    A features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpFrameDecoder.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpFrameDecoderTest.java

  Log Message:
  -----------
  NMS-6400: Add an RFC 6587 frame decoder for syslog over TCP

TCP carries no message boundaries, and RFC 6587 defines two incompatible ways to
supply them that senders disagree about. The decoder handles both: octet counting,
where a length prefix precedes each message, and non-transparent, where a newline
or a NUL separates them. Under the default auto it reads the framing from the
first frame of a connection and then latches it, since a stream that changes
framing cannot be decoded unambiguously and guessing per frame would turn a sender
bug into corrupt events.

A framing error leaves the position of every later message unknown, so
SyslogTcpExceptionHandler drops the connection and lets the sender resynchronise
rather than skipping bytes. Netty is used directly instead of through Camel
because the Camel netty component has no codec for octet counting.


  Commit: fcb9bac76ef18b3cc6bc6c9da5d1ac43d12e1eed
      https://github.com/OpenNMS/opennms/commit/fcb9bac76ef18b3cc6bc6c9da5d1ac43d12e1eed
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SinkDispatchingSyslogReceiver.java
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogReceiverJavaNetImpl.java
    A features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpListener.java
    A features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpSslContextFactory.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogClient.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpListenerDispatchIT.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpSslContextFactoryTest.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdMultiListenerIT.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdReceiverNettyTcpIT.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdReceiverNettyTcpTlsIT.java

  Log Message:
  -----------
  NMS-6400: Accept syslog over TCP and TLS

SyslogTcpListener owns the socket and hands decoded messages to a dispatcher that
belongs to someone else. It is deliberately not a second SyslogReceiver: a receiver
creates its own sink dispatcher, the Sink API names its metrics after the module
id, and a second dispatcher for the same module throws and takes its listener
down, sometimes the UDP one. SinkDispatchingSyslogReceiver therefore owns one
dispatcher and starts a TCP socket alongside its UDP one, which gives both
existing receiver implementations TCP without touching Syslogd.

Messages from one connection are dispatched one at a time, in arrival order, from
a pool thread rather than an event loop: AsyncDispatcher.send() blocks while the
sink queue is full and SyslogSinkModule asks for blockWhenFull, so dispatching on
an event loop stalls every connection on that worker. Reads are paused until the
dispatch returns, which turns a slow sink into TCP backpressure instead of
unbounded buffering, and the connection is not treated as idle while that is
outstanding. The wait for the dispatch is bounded, because after a Minion
configuration reload the sink delivers messages but completes the wrong futures.

TLS follows RFC 5425 and refuses to start on unusable certificate material rather
than falling back to plaintext on a port an operator believes is encrypted.


  Commit: 09ae8e321981d74f4562575db935fa8ae5906d4c
      https://github.com/OpenNMS/opennms/commit/09ae8e321981d74f4562575db935fa8ae5906d4c
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M features/events/syslog/blueprint-syslog-listener-camel-netty.xml
    M features/events/syslog/blueprint-syslog-listener-javanet.xml
    M opennms-container/minion/CONFD_README.md

  Log Message:
  -----------
  NMS-6400: Let a Minion listen for syslog over TCP

The TCP settings hang off the syslog listener feature a Minion already installs, as
syslog.tcp.* keys in org.opennms.netmgt.syslog.cfg, rather than a second feature.
syslog.tcp.listen.port defaults to 0, meaning off, because the .cfg always carries
the key. The placeholder already reloads, so a change takes effect through config
admin without restarting the container.


  Commit: b5df94eaea8eb2dc95c968f7af355ba4db08d29b
      https://github.com/OpenNMS/opennms/commit/b5df94eaea8eb2dc95c968f7af355ba4db08d29b
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M opennms-base-assembly/src/main/filtered/etc/syslogd-configuration.xml

  Log Message:
  -----------
  NMS-6400: Describe the TCP attributes in the shipped configuration

Commented out, so an install that is not touched keeps listening on UDP alone. The
example uses unprivileged ports, since the registered 601 and 6514 need a redirect
or added capabilities for a process that is not root.


  Commit: cadbf8f8c5c7dc7f7460a4778b0fc4790d23dbbf
      https://github.com/OpenNMS/opennms/commit/cadbf8f8c5c7dc7f7460a4778b0fc4790d23dbbf
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M docs/modules/operation/pages/deep-dive/events/sources/syslog.adoc
    M docs/modules/reference/pages/daemons/daemon-config-files/syslogd.adoc

  Log Message:
  -----------
  NMS-6400: Document syslog ingestion over TCP and TLS

Covers both framings and what a mismatch looks like from the outside, since that is
the failure operators will actually hit, along with the TLS attributes and the
Minion keys.


  Commit: 1d08313857e4d022c869b209964b6103bcf89a1f
      https://github.com/OpenNMS/opennms/commit/1d08313857e4d022c869b209964b6103bcf89a1f
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M smoke-test/src/main/java/org/opennms/smoketest/containers/MinionContainer.java
    M smoke-test/src/main/java/org/opennms/smoketest/stacks/NetworkProtocol.java
    M smoke-test/src/main/java/org/opennms/smoketest/utils/SyslogUtils.java
    A smoke-test/src/main/resources/syslog-tcp/org.opennms.netmgt.syslog.cfg
    A smoke-test/src/test/java/org/opennms/smoketest/minion/SyslogTcpIT.java

  Log Message:
  -----------
  NMS-6400: Add a smoke test for syslog over TCP to a Minion

Sends both framings to a Minion and counts the events that reach the core. The
count is exact rather than a lower bound, because over-delivery is what a framing
bug produces and a greater-than assertion would pass straight over one message
becoming several. The default Minion profile leaves the TCP port unset, so the
test brings its own .cfg.


  Commit: 587adba45018f249986610750720997b91eab453
      https://github.com/OpenNMS/opennms/commit/587adba45018f249986610750720997b91eab453
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    A dev/syslog-tcp-test/.gitignore
    A dev/syslog-tcp-test/Dockerfile
    A dev/syslog-tcp-test/README.md
    A dev/syslog-tcp-test/docker-compose.yml
    A dev/syslog-tcp-test/env.sh
    A dev/syslog-tcp-test/gen-certs.sh
    A dev/syslog-tcp-test/scripts/extra-runs.sh
    A dev/syslog-tcp-test/scripts/run-matrix.sh
    A dev/syslog-tcp-test/scripts/send.sh
    A dev/syslog-tcp-test/scripts/set-mode.sh
    A dev/syslog-tcp-test/scripts/start-core.sh
    A dev/syslog-tcp-test/scripts/start-minion.sh
    A dev/syslog-tcp-test/scripts/verify.sh
    A dev/syslog-tcp-test/senders/rsyslog/Dockerfile
    A dev/syslog-tcp-test/stage.sh
    A syslog-tcp-status.md

  Log Message:
  -----------
  NMS-6400: Add the end-to-end verification environment

Brings up a core and a Minion against real rsyslog and syslog-ng senders and walks
a matrix of both framings against plaintext, TLS and mutual TLS on both ingestion
paths. The three listener bugs that only appear against a real Minion were found
here, none of them reproducible through MockMessageDispatcherFactory, which never
blocks, always completes its futures and hands out a fresh MetricRegistry per call.


Compare: https://github.com/OpenNMS/opennms/compare/7c22422e3206%5E...587adba45018

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs