[OpenNMS/opennms] 1d3177: NMS-6400: Accept syslog over TCP and TLS

  Branch: refs/heads/mm/NMS-6400-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: 1d3177b106af94703004062348fb28cb050492cf
      https://github.com/OpenNMS/opennms/commit/1d3177b106af94703004062348fb28cb050492cf
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SinkDispatchingSyslogReceiver.java
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogReceiverJavaNetImpl.java
    A features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpListener.java
    A features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpSslContextFactory.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogClient.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpListenerDispatchIT.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpSslContextFactoryTest.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdMultiListenerIT.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdReceiverNettyTcpIT.java
    A features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdReceiverNettyTcpTlsIT.java

  Log Message:
  -----------
  NMS-6400: Accept syslog over TCP and TLS

SyslogTcpListener owns the socket and hands decoded messages to a dispatcher that
belongs to someone else. It is deliberately not a second SyslogReceiver: a receiver
creates its own sink dispatcher, the Sink API names its metrics after the module
id, and a second dispatcher for the same module throws and takes its listener
down, sometimes the UDP one. SinkDispatchingSyslogReceiver therefore owns one
dispatcher and starts a TCP socket alongside its UDP one, which gives both
existing receiver implementations TCP without touching Syslogd.

Messages from one connection are dispatched one at a time, in arrival order, from
a pool thread rather than an event loop: AsyncDispatcher.send() blocks while the
sink queue is full and SyslogSinkModule asks for blockWhenFull, so dispatching on
an event loop stalls every connection on that worker. Reads are paused until the
dispatch returns, which turns a slow sink into TCP backpressure instead of
unbounded buffering, and the connection is not treated as idle while that is
outstanding.

That leaves one message per connection riding on the sink confirming it, so the
wait is bounded by dispatch-timeout. Any sink slow enough to leave a future
uncompleted for that long would otherwise stall the connection outright, since
reads stay off until the dispatch returns. A Minion whose configuration was
reloaded is the case that never recovers, because the sink then delivers messages
while completing the wrong futures, but a merely busy sink reaches the same bound.
Past it the connection keeps delivering and gives up ordering and backpressure for
the rest of its life, which it logs, leaving the sink queue's own blockWhenFull as
the only thing underneath.

TLS follows RFC 5425 and refuses to start on unusable certificate material rather
than falling back to plaintext on a port an operator believes is encrypted.


  Commit: d0ef23f00040217216c2d113eb426d67ae27ee63
      https://github.com/OpenNMS/opennms/commit/d0ef23f00040217216c2d113eb426d67ae27ee63
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M features/events/syslog/blueprint-syslog-listener-camel-netty.xml
    M features/events/syslog/blueprint-syslog-listener-javanet.xml
    M opennms-container/minion/CONFD_README.md

  Log Message:
  -----------
  NMS-6400: Let a Minion listen for syslog over TCP

The TCP settings hang off the syslog listener feature a Minion already installs, as
syslog.tcp.* keys in org.opennms.netmgt.syslog.cfg, rather than a second feature.
syslog.tcp.listen.port defaults to 0, meaning off, because the .cfg always carries
the key. The placeholder already reloads, so a change takes effect through config
admin without restarting the container.


  Commit: 2b6bcbd999a1bed1a5115d95f77f23a30b5fc0da
      https://github.com/OpenNMS/opennms/commit/2b6bcbd999a1bed1a5115d95f77f23a30b5fc0da
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M opennms-base-assembly/src/main/filtered/etc/syslogd-configuration.xml

  Log Message:
  -----------
  NMS-6400: Describe the TCP attributes in the shipped configuration

Commented out, so an install that is not touched keeps listening on UDP alone. The
example uses unprivileged ports, since the registered 601 and 6514 need a redirect
or added capabilities for a process that is not root.


  Commit: fb59b843dee59d4a29408235132ff67f82c70b3e
      https://github.com/OpenNMS/opennms/commit/fb59b843dee59d4a29408235132ff67f82c70b3e
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M docs/modules/operation/pages/deep-dive/events/sources/syslog.adoc
    M docs/modules/reference/pages/daemons/daemon-config-files/syslogd.adoc

  Log Message:
  -----------
  NMS-6400: Document syslog ingestion over TCP and TLS

Covers both framings and what a mismatch looks like from the outside, since that is
the failure operators will actually hit, along with the TLS attributes and the
Minion keys.


  Commit: d66c4de13a23005860757f28cbbd4e89f26c7277
      https://github.com/OpenNMS/opennms/commit/d66c4de13a23005860757f28cbbd4e89f26c7277
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M smoke-test/src/main/java/org/opennms/smoketest/containers/MinionContainer.java
    M smoke-test/src/main/java/org/opennms/smoketest/stacks/NetworkProtocol.java
    M smoke-test/src/main/java/org/opennms/smoketest/utils/SyslogUtils.java
    A smoke-test/src/main/resources/syslog-tcp/org.opennms.netmgt.syslog.cfg
    A smoke-test/src/test/java/org/opennms/smoketest/minion/SyslogTcpIT.java

  Log Message:
  -----------
  NMS-6400: Add a smoke test for syslog over TCP to a Minion

Sends both framings to a Minion and counts the events that reach the core. The
count is exact rather than a lower bound, because over-delivery is what a framing
bug produces and a greater-than assertion would pass straight over one message
becoming several.

The .cfg that switches the port on is placed relative to the Minion's etc, since
the overlay is rsynced into it rather than into the Minion home.


  Commit: fcd886464c6838a63cc26da06abad8fba398d870
      https://github.com/OpenNMS/opennms/commit/fcd886464c6838a63cc26da06abad8fba398d870
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M docs/modules/operation/pages/deep-dive/events/sources/syslog.adoc
    M docs/modules/reference/pages/daemons/daemon-config-files/syslogd.adoc
    M features/events/syslog/blueprint-syslog-listener-camel-netty.xml
    M features/events/syslog/blueprint-syslog-listener-javanet.xml
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SinkDispatchingSyslogReceiver.java
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpListener.java
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpSslContextFactory.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpListenerDispatchIT.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpSslContextFactoryTest.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdMultiListenerIT.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdReceiverNettyTcpIT.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdReceiverNettyTcpTlsIT.java
    M opennms-base-assembly/src/main/filtered/etc/syslogd-configuration.xml
    M opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/Configuration.java
    M opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpConfig.java
    A opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpTlsConfig.java
    M opennms-config-model/src/main/resources/xsds/syslog.xsd
    M opennms-config-model/src/test/java/org/opennms/netmgt/config/syslogd/SyslogTcpConfigTest.java
    M opennms-config-model/src/test/java/org/opennms/netmgt/config/syslogd/SyslogdConfigurationTest.java

  Log Message:
  -----------
  NMS-6400: Model the TCP settings as a nested element

Review feedback: eleven attributes on the configuration element become an optional
tcp element carrying a nested tls one.

The presence of the element is now what asks for a listener, so port is required
inside it and the "unset means off" convention is gone from the XML. Grouping the
TLS settings also means a further one is an attribute on tls rather than another
tcp-tls-* attribute on the parent, which is already wide.

The .cfg keys a Minion uses are unchanged. Its blueprint builds the nested bean and
injects it, which is the same object graph the XML unmarshals into.

The tcp element may only appear once, matching what the runtime supports. Raising
that later is a schema change plus the work to own more than one listener.

Two details worth keeping:

The listen-address of the parent is still the fallback for the tcp element, passed
to the listener rather than copied into the element, so it does not reappear when
the configuration is marshalled. Binding TCP to every address while UDP was
restricted to one interface is a poor surprise.

The tls enabled attribute is a primitive. A nullable Boolean setter alongside a
boolean getter makes the property read-only under bean introspection, which the
blueprint rejects, and absence means false either way.


  Commit: ab6ba8c1f47443ea6f3b0424a4e3bfb4ecd05780
      https://github.com/OpenNMS/opennms/commit/ab6ba8c1f47443ea6f3b0424a4e3bfb4ecd05780
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M docs/modules/operation/pages/deep-dive/events/sources/syslog.adoc
    M features/events/syslog/blueprint-syslog-listener-camel-netty.xml
    M features/events/syslog/blueprint-syslog-listener-javanet.xml
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SinkDispatchingSyslogReceiver.java
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpFrameDecoder.java
    M features/events/syslog/src/main/java/org/opennms/netmgt/syslogd/SyslogTcpListener.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogTcpFrameDecoderTest.java
    M features/events/syslog/src/test/java/org/opennms/netmgt/syslogd/SyslogdMultiListenerIT.java
    M opennms-base-assembly/src/main/filtered/etc/syslogd-configuration.xml
    M opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpConfig.java
    M opennms-config-model/src/main/java/org/opennms/netmgt/config/syslogd/SyslogTcpTlsConfig.java
    M opennms-config-model/src/main/resources/xsds/syslog.xsd
    M opennms-config-model/src/test/java/org/opennms/netmgt/config/syslogd/SyslogTcpConfigTest.java
    M opennms-config/src/main/java/org/opennms/netmgt/config/SyslogdConfig.java
    M opennms-config/src/main/java/org/opennms/netmgt/config/SyslogdConfigFactory.java
    M opennms-container/minion/CONFD_README.md

  Log Message:
  -----------
  NMS-6400: Keep a bad TCP property from taking UDP down on a Minion

Review feedback. The Core was already protected, since the receiver wraps its TCP
setup in a catch. A Minion was not: there SyslogTcpConfig is a Blueprint bean, its
setters validated, and a bean that throws fails the container that also owns the
UDP listener. A typo in any one of six properties bound zero sockets.

The setters now accept anything and SyslogTcpConfig.validate() reports the same
problems, called by the listener before it binds. So a bad value leaves TCP down
with an error in the log and UDP running, matching the Core. The XML path still
fails on load, because the schema rejects those values. Blueprint's own String to
int conversion still fails the container on a non-numeric value, which is outside
this code.

getTcpConfig() is defaulted rather than abstract so an implementation outside this
repository keeps compiling, and its javadoc no longer promises non-null while the
factory could return null.

An oversized frame under non-transparent framing now loses the message rather than
the connection: the trailer is already in hand, so the next message starts after
it. The octet-counted path still closes, because a length prefix that cannot be
trusted leaves the next message nowhere in particular.

The wait for a dispatch is configurable as dispatch-timeout rather than a constant
only tests could reach, and zero waits indefinitely. Reaching it costs ordering and
read backpressure for the life of that connection, so the warning now says so and
names the knob.

Connections refused at max-connections warn once a minute instead of only at debug,
where an operator at the cap saw nothing.


Compare: https://github.com/OpenNMS/opennms/compare/09217fba05ff...ab6ba8c1f474

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs