Graylog2 / Graylog2/graylog2-server
CEF TCP input: support octet-counting format
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
[GL Documentation](https://docs.graylog.org/en/4.0/pages/sending/syslog.html?highlight=octet-counting#ingest-syslog) states that we support both “Non-Transparent-Framing” and "octet-counting" mode for syslog.
However, a CEF TCP input is not able to handle "octet-counting" mode: multiple messages appear to be parsed as a single, excessively long message, leading to confusing errors.
## Customer scenario
Fortinet recommended enabling "enhanced logging," which switched the firewalls over to using the "reliable TCP" mode of transmission; this is an octet-counting CEF format. Our CEF input appeared to stop working with no good diagnostic information in the log file.
## Customer impact
In the Fortinet scenario, customer was able to simply revert to using the previous format. However, CEF input was offline for a considerable amount of time while trouble-shooting the issue. Messages sent during this time were lost.
## References
https://docs.graylog.org/en/4.0/pages/sending/syslog.html
https://kb.fortinet.com/kb/documentLink.do?externalID=FD45621
https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-23/CommonEventFormatV25.pdf
https://datatracker.ietf.org/doc/html/rfc6587
https://datatracker.ietf.org/doc/html/rfc5424
HS-441221484
Contributor guide
Assessment
This issue has not been assessed yet.