syslog input does not work on Windowss

[edespong]

Bug Report

Describe the bug

The documentation around the syslog input does not say anything about restrictions and that it is not available on Windows.

But if you try to run with the syslog input on Windows, it fails with the message [error] [config] section 'syslog' tried to instance a plugin name that don't exists. The issue 5153 goes into the reason to why this happens. But it does not answer the question if this is intentional, and whether there is a plan to fix it.

Furthermore, the issue 960 Add Windows Support to Fluent Bit lists in_syslog as one of the high priority plugins that would be ported, and no mention that it was not.

To Reproduce
Configure fluent-bit to run with the syslog input on a Windows machine.

Expected behavior
syslog either working, or it being documented that it does not, with a strong preference to the former.

Your Environment

• Version used: 2.0.9
• Configuration:
  [INPUT]
  Name syslog
  Parser syslog-rfc3164
  Mode tcp
  Listen 0.0.0.0
  Port 24225
  Buffer_Chunk_Size 32KB
  Buffer_Max_Size 64KB
• Operating System and version: Windows Server 2019
• Filters and plugins: syslog

Additional context

syslog is used for ATNA which is used in Windows-heavy environments.

[edespong]

I am not quite sure what you mean. There is no log file to tail in my case, only a program sending to a tcp port. Could you elaborate how the tail input could be used instead of syslog input in that case?

[patrick-stephens]

@edespong I cannot comment on whether it should work on Windows or not but by default it is disabled (and will be in any official packages):

fluent-bit/cmake/windows-setup.cmake

Line 42 in 8144c1f

set(FLB_IN_SYSLOG No)

[edsiper]

cc: @leonardo-albertovich can you check if this plugin can be enabled on windows ?

[patrick-stephens]

I've updated the docs with a quick link out to the default config just to at least point people in the right direction.

Longer term we want those docs to auto-generate a matrix of supported plugins really - possibly as part of the release process we can just run the binary to get the list of plugins and inject that into a docs PR similar to the Windows/Docker updates we do for docs now automatically.

[edespong]

I might try to build from source at some point and use set(FLB_IN_SYSLOG Yes) and see what breaks. But from my understanding, there is no principal decision that syslog should not be on Windows, just that it has not been ported/tested yet.

[leonardo-albertovich]

I think there could be a minor piece of code here and there to disable in windows when it comes to UDS mode support but that shouldn't be a show stopper.

I'm saving this issue and I'll try to make the required changes for the following release. Please let me know if I miss it.