---
title: "unix-stream, unix-dgram: Collect messages from UNIX domain sockets"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-sources/source-unixstream/"
last_modified: "2026-05-08T12:04:12+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# unix-stream, unix-dgram: Collect messages from UNIX domain sockets

The `unix-stream()` and `unix-dgram()` drivers open an `AF_UNIX` socket and start listening on it for messages. On Linux both the `unix-stream()` and `unix-dgram()` drivers are used and are always reliable. The `unix-stream()` driver uses `SOCK_STREAM` semantics (connection oriented), while `unix-dgram()` is used on BSDs and uses `SOCK_DGRAM` semantics.

To avoid denial of service attacks when using connection-oriented protocols, the number of simultaneously accepted connections should be limited. This can be achieved using the `max-connections()` parameter. The default value of this parameter is quite strict, you might have to increase it on a busy system.

Both `unix-stream()` and `unix-dgram()` have a single required argument that specifies the filename of the socket to create. For the list of available optional parameters, see [unix-stream() and unix-dgram() source options](https://axoflow.com/docs/axosyslog-core/4.28/chapter-sources/source-unixstream/reference-source-unixstream/index.md)

## Declaration

```shell
   unix-stream(filename [options]);
    unix-dgram(filename [options]);
```

> **Note:**
> `syslogd` on Linux originally used `SOCK_STREAM` sockets, but some distributions switched to `SOCK_DGRAM` around 1999 to fix a possible DoS problem. On Linux you can choose to use whichever driver you like as syslog clients automatically detect the socket type being used.

## Example: Using the unix-stream() and unix-dgram() drivers

```shell
   source s_stream {
        unix-stream("/dev/log" max-connections(10));
    };
```

```shell
   source s_dgram {
        unix-dgram("/var/run/log");
    };
```

---

[UNIX credentials and other metadata](https://axoflow.com/docs/axosyslog-core/4.28/chapter-sources/source-unixstream/unixstream-unix-credentials/index.md)

[unix-stream() and unix-dgram() source options](https://axoflow.com/docs/axosyslog-core/4.28/chapter-sources/source-unixstream/reference-source-unixstream/index.md)

Last modified May 8, 2026: [Marks sources where we do syslog parsing automatically (5b8c29b7)](https://github.com/axoflow/axosyslog-core-docs/commit/5b8c29b7e7ee800add5a73ae2fe07f4db5115f6c)