binfile module is very similar to the
textfile module. It reads data from a binary file instead of a text file, and returns blocks of raw data instead of text lines. It can read data from text files, from Unix pipes and from Unix (
AF_UNIX) TCP sockets.
binfile module is an input module, meaning that its purpose is to read data from some sources, and convert it to Orchids events. The sources should be declared in the
orchids-inputs.conf file, by directives such as:
INPUT binfile /var/log/bsm/current
Admissible sources are regular files, Posix pipes and Unix (
AF_UNIX) TCP sockets (
binfile module reads from these sources and produces Orchids events, one per block of data. The size of each block is currently hard-coded (to 1024 bytes). Actual blocks may be smaller. The contents of each block will then be found in the
.binfile.block field of the event. The name of the source, as given in the
orchids-inputs.conf file, will be in
PollPeriodsecs: instructs Orchids that it should poll files read by the binfile module every secs seconds. There is no way to specify a polling period of less than 1 second. This takes precedence over the general
ProcessAlln: if n is non-zero, read all lines from the start of the file. This only applies to files, not pipes or Unix TCP sockets, and is meant to analyze log files, offline. The default behavior (n=0) is to read only lines added after Orchids started, through polling.
ExitAfterProcessAlln: if n is non-zero, shutdown Orchids after the end of file has been met. On pipes and sockets, this will cause Orchids to shutdown when the pipe or socket is closed. This is meant to analyze a single log file, offline. If different input sources are specified, Orchids will exit regardless of the fact that there are still events pending from the other sources. The default behavior (n=0) is to continue polling, waiting for extra data, once the end of file has been reached.
binfile module also understands options named
AddInputFile. They are synonyms, take a file, pipe or Unix socket name as argument, which they open and use as input to the
binfile module. They should not be used inside the
binfile module configuration file. Instead, input should be specified in the
The last field is
.binfile.block, available for further dissection; the dissection key is
||source file name|
||current data block|