Graylog2 / Graylog2/graylog2-server
VMware-logs incorrectly detected as RFC5424
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Hi,
the logs from vmware are incorrectly detected as RFC5425.
vmvware is sending messages like this:
<166>**2**016-01-29T15:20:31.960Z srv01esx70 Vpxa: [FF8DFB70 verbose 'VpxaHalCnxHostagent' opID=WFU-ba76b75e] [WaitForUpdatesDone] Completed callback
due to the digit immediatly after the it is incorrectly detected as RFC5424.
the regex at graylog2-server/graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java line 63 is `"<\\d+>\\d.*", Pattern.DOTALL` which matches every digit.
According to RFC5424 the VERSION field is a one to three digit number never starting with a 'zero' which must be followed by a space. Improving this regex to this:
`"^<\\d{1,3}>[1-9]\\d{0,2}\s.*"` should fix this issue.
Please check the escaping since I'm not familiar with with Java Patterns.
Best Regards. Jörg
Contributor guide
Assessment
This issue has not been assessed yet.