Graylog2 / Graylog2/graylog2-server
RFC 3164 Hostname included in message field
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The syslog parser adds the hostname to the message field when parsing RFC 3164 messages. Hostname gets correctly set in the source field.
## Expected Behavior
Full message: `<78>Jan 1 12:15:00 nas.example 1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`
Expected message field: `1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`
## Current Behavior
Full message:`<78>Jan 1 12:15:00 nas.example 1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`
Current message field: `nas.example 1 1970-01-01T12:15:00.005048-00:00 nas.example /usr/sbin/cron 61898 - - (root) CMD (/usr/libexec/atrun)`
## Possible Solution
## Steps to Reproduce (for bugs)
Configure TrueNAS to send syslog to Graylog.
Receive syslog input and view message field after parsing.
## Context
TrueNAS (and apparently BSD in general) have badly set up RFC 3164 formatting, but having the hostname prepended to the message field makes cleaning it up require another step that should not be necessary.
## Your Environment
* Graylog Version: 5.1.7 docker
* Java Version: docker image
* OpenSearch Version: 2.4.0
* MongoDB Version: 5.0
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.