Graylog2 / Graylog2/graylog2-server

RFC 3164 Hostname included in message field

Open
#17,062 2 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The syslog parser adds the hostname to the message field when parsing RFC 3164 messages. Hostname gets correctly set in the source field.

## Expected Behavior
Full message: `<78>Jan 1 12:15:00 nas.example 1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`
Expected message field: `1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`

## Current Behavior
Full message:`<78>Jan 1 12:15:00 nas.example 1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`
Current message field: `nas.example 1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`

## Possible Solution

## Steps to Reproduce (for bugs)
Configure TrueNAS to send syslog to Graylog.
Receive syslog input and view message field after parsing.

## Context
TrueNAS (and apparently BSD in general) have badly set up RFC 3164 formatting, but having the hostname prepended to the message field makes cleaning it up require another step that should not be necessary.

## Your Environment

* Graylog Version: 5.1.7 docker
* Java Version: docker image
* OpenSearch Version: 2.4.0
* MongoDB Version: 5.0
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.