Graylog2 / Graylog2/graylog2-server

VMware-logs incorrectly detected as RFC5424

Open
#1,739 2 comments 0 reactions 0 assignees View on GitHub
bug P4 processing S2 severe triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Hi,
the logs from vmware are incorrectly detected as RFC5425.
vmvware is sending messages like this:

<166>**2**016-01-29T15:20:31.960Z srv01esx70 Vpxa: [FF8DFB70 verbose 'VpxaHalCnxHostagent' opID=WFU-ba76b75e] [WaitForUpdatesDone] Completed callback

due to the digit immediatly after the it is incorrectly detected as RFC5424.
the regex at graylog2-server/graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java line 63 is `"<\\d+>\\d.*", Pattern.DOTALL` which matches every digit.

According to RFC5424 the VERSION field is a one to three digit number never starting with a 'zero' which must be followed by a space. Improving this regex to this:

`"^<\\d{1,3}>[1-9]\\d{0,2}\s.*"` should fix this issue.

Please check the escaping since I'm not familiar with with Java Patterns.

Best Regards. Jörg

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.