Signal Server (Push Ingestion)¶

Signal Server handles push-based log ingestion from network sources. It listens on multiple protocols and ports, buffering incoming data before publishing to the NATS artifacts.raw stream for downstream processing.

Listeners¶

Each listener runs as an independent connector following the Source → Flow → Sink pattern:

1. Source — Network listener accepting connections on the configured port
2. Buffer — Internal event buffer (5000 event capacity) for backpressure management
3. Flow — Transforms raw network data into ArtifactRaw format
4. Sink — Publishes to NATS JetStream on the artifacts.raw subject

Configuration¶

Signal Server is configured via the NATS KV SERVERS bucket. Each listener can be independently enabled or disabled through the Conductor UI Log Server page.

Masquerading¶

Signal Server supports protocol masquerading, which allows a listener to accept data in one format and tag it as another. This is useful when network devices send non-standard syslog formats or when protocol conversion is needed at the ingestion point.

Performance¶

• TCP timeout: 60 seconds (industry standard for log collectors)
• Lumberjack protocol: Payload validation with 10 MB compressed limit and 4096 events per window
• Non-blocking sends: All framers use non-blocking channel sends to prevent connection hangs
• Buffer capacity: 5000 events per listener with backpressure management