Add agent-side UDP/TCP Syslog listener support to Logcollector

Add native agent-side Syslog listener support so the Wazuh agent can
receive basic Syslog messages directly over UDP or TCP, instead of
requiring an external service to write them to a file first. Received
messages enter the existing Logcollector processing path and are sent
through the standard agent-to-manager pipeline, remaining associated
with the receiving agent.

- New SyslogReader (IReader) implementing UDP and TCP listeners with the
  Boost.Asio coroutine model used by the other readers.
- SetupSyslogReaders parses a new logcollector.syslog configuration
  section and creates one listener per definition; multiple independent
  listeners are supported.
- Validation before any listener starts: protocol (udp/tcp), port range
  (1-65535), bind address, and duplicate protocol+address+port detection.
  Invalid or duplicate entries are logged and skipped, so no listener is
  silently enabled. bind_address defaults to 127.0.0.1.
- Clean startup/shutdown: sockets are closed on the io_context thread and
  TCP client sockets are tracked and closed on stop.
- Backward compatibility preserved for file, journald, windows and macOS
  collectors; manager-side remote Syslog is unchanged.
- Unit tests for configuration parsing/validation and runtime UDP/TCP
  receipt, plus reference documentation and sample configuration.

Related to wazuh/wazuh#15178.

Author: allamiro

docs/ref/modules/logcollector/README.md

@@ -83,6 +83,80 @@ This collector gets logs from Journald on Linux. It needs a field and a value to
 |           | journald.ignore_if_missing | Boolean to ignore the filtering condition for logs without the specified field               | false   |
 |           | journald.conditions        | Vector of journald fields to filter to be applied simultaneously                             |         |
 
+### Agent-side Syslog listener
+
+The Wazuh agent can optionally receive basic Syslog messages directly over UDP or
+TCP through the Logcollector module. This is useful for lightweight remote-site
+deployments where nearby devices or applications need to forward Syslog to a local
+Wazuh agent, while preserving the agent-based collection model. Received messages
+enter the normal Logcollector processing path and are sent through the standard
+agent-to-manager pipeline, so they remain associated with the receiving agent.
+
+No listener is started unless it is explicitly configured. Each `syslog` entry
+defines one listener (one protocol, bind address and port). Several entries may be
+combined to run multiple independent listeners on the same agent.
+
+```yaml
+logcollector:
+  enabled: true
+  syslog:
+    # UDP listener on localhost
+    - protocol: udp
+      bind_address: 127.0.0.1
+      port: 5514
+    # UDP listener on a specific interface
+    - protocol: udp
+      bind_address: 192.168.10.20
+      port: 5515
+    # TCP listener on localhost
+    - protocol: tcp
+      bind_address: 127.0.0.1
+      port: 1514
+```
+
+`bind_address` is optional and defaults to `127.0.0.1`. Binding to `0.0.0.0` (all
+interfaces) must be configured explicitly. Each message is forwarded with the
+`remote-syslog` collector type and the listener identity (`<protocol>:<address>:<port>`)
+as its provider:
+
+```json
+{"module":"logcollector","collector":"remote-syslog"}
+{"event":{"created":"2025-01-17T17:58:26.212Z","original":"<13>Jun 25 10:00:00 testhost testapp: UDP listener test","provider":"udp:127.0.0.1:5514"}}
+```
+
+| Mandatory | Option              | Description                                                              | Default   |
+| :-------: | ------------------- | ----------------------------------------------------------------------- | --------- |
+|     ✔️     | syslog              | Vector of agent-side syslog listeners                                   |           |
+|     ✔️     | syslog.protocol     | Listener transport protocol: `udp` or `tcp`                             |           |
+|     ✔️     | syslog.port         | Listener port (1-65535)                                                  |           |
+|           | syslog.bind_address | Address the listener binds to                                           | 127.0.0.1 |
+
+A listener definition is rejected (and the listener is not started) when the
+protocol is not `udp`/`tcp`, the port is missing or out of range, the bind address
+is malformed, or another listener already uses the same protocol, bind address and
+port combination.
+
+> **Note:** For high-volume Syslog ingestion, TLS Syslog, disk-assisted queues,
+> advanced filtering, transformations, routing, or complex parsing pipelines, use
+> rsyslog, syslog-ng, Logstash, or the Wazuh manager remote Syslog input as
+> appropriate. Source IP filtering for the agent-side listener should be handled
+> with host firewall rules.
+
+#### Limitations and future work
+
+This first version implements only the UDP/TCP IP-socket listeners from
+[wazuh/wazuh#15178](https://github.com/wazuh/wazuh/issues/15178). The following are
+intentionally **not** included yet and are tracked as future work:
+
+| Not yet supported | Notes |
+| ----------------- | ----- |
+| UNIX domain sockets (`unix_stream`, `unix_dgram`, `unix_seq`) | Local socket ingress requested in #15178; reuses the Boost.Asio local-socket pattern. |
+| Named pipe / FIFO (and Windows named pipes) | Pipe ingress requested in #15178; equivalent to the legacy `syslog-pipe` format. |
+| TLS Syslog (TCP) | The TCP listener is plaintext; use rsyslog/syslog-ng for TLS. |
+| TCP octet-counting framing (RFC 6587) | Only newline-delimited ("non-transparent") framing is parsed. Octet-counted messages (`<len> <msg>`) are not auto-detected. |
+| Hostname `bind_address` | Only numeric IP literals (IPv4/IPv6) are accepted; DNS names are rejected. |
+| `allowed-ips` source filtering | Restrict senders with host firewall rules until implemented. |
+
 ### Windows Collector
 
 ```yaml

docs/ref/modules/logcollector/architecture.md

@@ -61,11 +61,20 @@ classDiagram
         + Run()
         + Stop()
     }
+    class SyslogReader {
+        - protocol : SyslogProtocol
+        - bindAddress : string
+        - port : uint16
+        + SyslogReader(protocol, bindAddress, port)
+        + Run()
+        + Stop()
+    }
     IModule <-- Logcollector
     Logcollector o-- IReader
     IReader <|-- FileReader
     IReader <|-- JournaldReader
     IReader <|-- WindowsEventTracerReader
     IReader <|-- MacosReader
+    IReader <|-- SyslogReader
     FileReader o-- LocalFile
 ```

etc/config/wazuh_agent_linux.yml

@@ -29,3 +29,12 @@ logcollector:
       value: 0|1|2|3|4|5|6|7
       exact_match: true
       ignore_if_missing: true
+  # Agent-side syslog listeners (UDP/TCP). Disabled by default: no listener is
+  # started unless explicitly configured here. bind_address defaults to 127.0.0.1.
+  # syslog:
+  #   - protocol: udp
+  #     bind_address: 127.0.0.1
+  #     port: 5514
+  #   - protocol: tcp
+  #     bind_address: 127.0.0.1
+  #     port: 1514

etc/config/wazuh_agent_macos.yml

@@ -24,3 +24,12 @@ logcollector:
   read_interval: 500ms
   macos:
     - level: info
+  # Agent-side syslog listeners (UDP/TCP). Disabled by default: no listener is
+  # started unless explicitly configured here. bind_address defaults to 127.0.0.1.
+  # syslog:
+  #   - protocol: udp
+  #     bind_address: 127.0.0.1
+  #     port: 5514
+  #   - protocol: tcp
+  #     bind_address: 127.0.0.1
+  #     port: 1514

etc/config/wazuh_agent_windows.yml

@@ -27,5 +27,14 @@ logcollector:
     - channel: System
     - channel: Application
     - channel: Security
+  # Agent-side syslog listeners (UDP/TCP). Disabled by default: no listener is
+  # started unless explicitly configured here. bind_address defaults to 127.0.0.1.
+  # syslog:
+  #   - protocol: udp
+  #     bind_address: 127.0.0.1
+  #     port: 5514
+  #   - protocol: tcp
+  #     bind_address: 127.0.0.1
+  #     port: 1514
 
 

src/modules/logcollector/CMakeLists.txt

@@ -16,7 +16,7 @@ find_package(cJSON CONFIG REQUIRED)
 find_package(nlohmann_json CONFIG REQUIRED)
 find_package(Boost REQUIRED COMPONENTS asio)
 
-file(GLOB LOGCOLLECTOR_SOURCES src/*.cpp src/file_reader/src/*.cpp)
+file(GLOB LOGCOLLECTOR_SOURCES src/*.cpp src/file_reader/src/*.cpp src/syslog_reader/src/*.cpp)
 file(GLOB JOURNALD_SOURCES src/journald_reader/src/*.cpp)
 file(GLOB MACOS_SOURCES src/macos_reader/src/*.cpp)
 file(GLOB WIN_SOURCES src/winevt_reader/src/*.cpp)
@@ -44,6 +44,7 @@ target_include_directories(
     PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/include
     PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src
             ${CMAKE_CURRENT_SOURCE_DIR}/src/file_reader/include
+            ${CMAKE_CURRENT_SOURCE_DIR}/src/syslog_reader/include
             $<$<PLATFORM_ID:Linux>:${CMAKE_CURRENT_SOURCE_DIR}/src/journald_reader/include>
             $<$<PLATFORM_ID:Linux>:${SYSTEMD_INCLUDE_DIRS}>
             $<$<PLATFORM_ID:Windows>:${CMAKE_CURRENT_SOURCE_DIR}/src/winevt_reader/include>

src/modules/logcollector/include/logcollector.hpp

@@ -81,6 +81,15 @@ namespace logcollector
         /// @param configurationParser Configuration parser
         void SetupFileReader(const std::shared_ptr<const configuration::ConfigurationParser> configurationParser);
 
+        /// @brief Sets up the agent-side syslog listeners (UDP/TCP)
+        ///
+        /// Reads every listener definition from the configuration, validates it and
+        /// creates one reader per valid definition. Invalid or duplicate definitions
+        /// are reported and skipped so that no listener is silently started.
+        ///
+        /// @param configurationParser Configuration parser
+        void SetupSyslogReaders(const std::shared_ptr<const configuration::ConfigurationParser> configurationParser);
+
         /// @brief Clean all readers
         void CleanAllReaders();
 

src/modules/logcollector/src/logcollector.cpp

@@ -2,17 +2,23 @@
 
 #include <boost/asio/co_spawn.hpp>
 #include <boost/asio/detached.hpp>
+#include <boost/asio/ip/address.hpp>
 #include <boost/asio/redirect_error.hpp>
 #include <config.h>
 #include <logger.hpp>
 #include <timeHelper.hpp>
 
+#include <algorithm>
+#include <cctype>
 #include <chrono>
+#include <cstdint>
 #include <iomanip>
 #include <map>
+#include <set>
 #include <sstream>
 
 #include "file_reader.hpp"
+#include "syslog_reader.hpp"
 
 using namespace logcollector;
 
@@ -66,9 +72,106 @@ void Logcollector::Setup(std::shared_ptr<const configuration::ConfigurationParse
         configurationParser->GetConfigOrDefault(config::logcollector::DEFAULT_ENABLED, "logcollector", "enabled");
 
     SetupFileReader(configurationParser);
+    SetupSyslogReaders(configurationParser);
     AddPlatformSpecificReader(configurationParser);
 }
 
+void Logcollector::SetupSyslogReaders(
+    const std::shared_ptr<const configuration::ConfigurationParser> configurationParser)
+{
+    const auto syslogConfigs = configurationParser->GetConfigOrDefault<YAML::Node>(
+        YAML::Node(YAML::NodeType::Sequence), "logcollector", "syslog");
+
+    constexpr int MIN_PORT = 1;
+    constexpr int MAX_PORT = 65535;
+
+    std::set<std::string> seenListeners;
+
+    for (const auto& config : syslogConfigs)
+    {
+        if (!config.IsMap())
+        {
+            LogWarn("Invalid agent-side syslog listener configuration: entry is not a mapping.");
+            continue;
+        }
+
+        auto protocolStr = config["protocol"].as<std::string>("");
+        std::transform(protocolStr.begin(),
+                       protocolStr.end(),
+                       protocolStr.begin(),
+                       [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+
+        SyslogProtocol protocol = SyslogProtocol::Udp;
+        if (protocolStr == "udp")
+        {
+            protocol = SyslogProtocol::Udp;
+        }
+        else if (protocolStr == "tcp")
+        {
+            protocol = SyslogProtocol::Tcp;
+        }
+        else
+        {
+            LogError("Invalid agent-side syslog listener configuration: unsupported protocol {}.",
+                     protocolStr.empty() ? "(missing)" : protocolStr);
+            continue;
+        }
+
+        if (!config["port"])
+        {
+            LogError("Invalid agent-side syslog listener configuration: missing port.");
+            continue;
+        }
+
+        int port = 0;
+        try
+        {
+            port = config["port"].as<int>();
+        }
+        catch (const std::exception&)
+        {
+            LogError("Invalid agent-side syslog listener configuration: invalid port {}.",
+                     config["port"].as<std::string>(""));
+            continue;
+        }
+
+        if (port < MIN_PORT || port > MAX_PORT)
+        {
+            LogError("Invalid agent-side syslog listener configuration: invalid port {}.", port);
+            continue;
+        }
+
+        const auto bindAddress = config["bind_address"].as<std::string>("127.0.0.1");
+
+        boost::system::error_code ec;
+        boost::asio::ip::make_address(bindAddress, ec);
+        if (ec)
+        {
+            LogError("Invalid agent-side syslog listener configuration: invalid bind address {}.", bindAddress);
+            continue;
+        }
+
+        const auto listenerId =
+            SyslogReader::ProtocolToString(protocol) + ":" + bindAddress + ":" + std::to_string(port);
+
+        if (!seenListeners.insert(listenerId).second)
+        {
+            LogError("Invalid agent-side syslog listener configuration: duplicate listener {}.", listenerId);
+            continue;
+        }
+
+        AddReader(std::make_shared<SyslogReader>(
+            [this](const std::string& location, const std::string& log, const std::string& collectorType)
+            { PushMessage(location, log, collectorType); },
+            // NOLINTNEXTLINE(cppcoreguidelines-avoid-capturing-lambda-coroutines)
+            [this](std::chrono::milliseconds duration) -> Awaitable { co_await Wait(duration); },
+            [this](Awaitable task) { EnqueueTask(std::move(task)); },
+            protocol,
+            bindAddress,
+            static_cast<std::uint16_t>(port)));
+    }
+}
+
 void Logcollector::SetupFileReader(const std::shared_ptr<const configuration::ConfigurationParser> configurationParser)
 {
     const auto fileWait = configurationParser->GetTimeConfigOrDefault(