Graylog2 / Graylog2/graylog2-server

CEF TCP input: support octet-counting format

Open
#10,863 1 comment 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

[GL Documentation](https://docs.graylog.org/en/4.0/pages/sending/syslog.html?highlight=octet-counting#ingest-syslog) states that we support both “Non-Transparent-Framing” and "octet-counting" mode for syslog.
However, a CEF TCP input is not able to handle "octet-counting" mode: multiple messages appear to be parsed as a single, excessively long message, leading to confusing errors.

## Customer scenario
Fortinet recommended enabling "enhanced logging," which switched the firewalls over to using the "reliable TCP" mode of transmission; this is an octet-counting CEF format. Our CEF input appeared to stop working with no good diagnostic information in the log file.

## Customer impact
In the Fortinet scenario, customer was able to simply revert to using the previous format. However, CEF input was offline for a considerable amount of time while trouble-shooting the issue. Messages sent during this time were lost.

## References
https://docs.graylog.org/en/4.0/pages/sending/syslog.html
https://kb.fortinet.com/kb/documentLink.do?externalID=FD45621
https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-23/CommonEventFormatV25.pdf
https://datatracker.ietf.org/doc/html/rfc6587
https://datatracker.ietf.org/doc/html/rfc5424

HS-441221484

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.