The binfile module is very similar to the textfile module.  It reads data from a binary file instead of a text file, and returns blocks of raw data instead of text lines.  It can read data from text files,  from Unix pipes and from Unix (AF_UNIX) TCP sockets.

The binfile module is  an input module, meaning that its purpose is to read data from some sources, and convert it to Orchids events.  The sources  should be declared in the orchids-inputs.conf file, by directives such as:

INPUT binfile /var/log/bsm/current

Admissible sources are regular files, Posix pipes and Unix (AF_UNIX) TCP sockets (SOCK_STREAM).

Internet (AF_INET) sockets are not handled, and should be dealt with using the udp module.  Unix UDP sockets (SOCK_DGRAM) should be dealt with using the sockunix module.

The binfile module reads from these sources and produces Orchids events, one per block of data.  The size of each block is currently hard-coded (to 1024 bytes).  Actual blocks may be smaller.  The contents of each block will then be found in the .binfile.block field of the event.  The name of the source, as given in the orchids-inputs.conf file, will be in .binfile.file.

Configuration options

<module binfile>

• PollPeriod secs: instructs Orchids that it should poll files read by the binfile module every secs seconds. There is no way to specify a polling period of less than 1 second. This takes precedence over the general PollPeriod directive.
• ProcessAll n: if n is non-zero, read all lines from the start of the file. This only applies to files, not pipes or Unix TCP sockets, and is meant to analyze log files, offline. The default behavior (n=0) is to read only lines added after Orchids started, through polling.
• ExitAfterProcessAll n: if n is non-zero, shutdown Orchids after the end of file has been met. On pipes and sockets, this will cause Orchids to shutdown when the pipe or socket is closed. This is meant to analyze a single log file, offline. If different input sources are specified, Orchids will exit regardless of the fact that there are still events pending from the other sources. The default behavior (n=0) is to continue polling, waiting for extra data, once the end of file has been reached.

</module>

The binfile module also understands options named INPUT and AddInputFile.  They are synonyms, take a file, pipe or Unix socket name as argument, which they open and use as input to the binfile module.  They should not be used inside the binfile module configuration file.  Instead, input should be specified in the orchids-inputs.conf file.

Fields

The last field is .binfile.block, available for further dissection; the dissection key is .binfile.file.

Field	Type	Mono?	Description
.textfile.file	str		source file name
.textfile.block	bstr		current data block