Graylog2 / Graylog2/graylog2-server

Incorrect parsing of RFC5424 syslog input

Open
#4,689 2 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Examples of lines which are not parsed correctly:
```
full_message
<34>1 2018-03-25T22:14:15.003Z mymachine.example.com su - ID47 - 'su root' failed for lonvick on /dev/pts/8
---
full_message
<131>1 2018-03-26T08:19:40.760962Z host_pac amstest_libamsloggingtools 11348 Log2 - (SyslogTCPLogSink.cpp:35) Value 16
```
First example line is taken directly from the [RFC5424 examples](https://tools.ietf.org/html/rfc5424#section-6.5), only the date has been modified and BOM removed (which is OK according to the [RFC5424 grammar](https://tools.ietf.org/html/rfc5424#section-6)).

## Expected Behavior
Fields `msg_id` (or similar) and `message` should be parsed out properly. For the first example message, I would expect `msg_id` to be `ID47` and `message` to be `'su root' failed for lonvick on /dev/pts/8`.

## Current Behavior
For the first example message, I get only `message` field:
```
message
ID47 - 'su root' failed for lonvick on /dev/pts/8
```
It seems that the input parser ignores the fact that the `-` in the original message is `STRUCTURED-DATA = NILVALUE` in the above mentioned grammar, not part of any message. In this example, there should be no `-` in the message at all. The `msg_id` field seems to be currently completely ignored by the Graylog.

Similarly in the second example, Graylog reports:
```
message
Log2 - (SyslogTCPLogSink.cpp:35) Value 16
```
But expected would be to have `msg_id` of `Log2` and message `(SyslogTCPLogSink.cpp:35) Value 16`.

## Steps to Reproduce (for bugs)
Just send above mentioned example messages to the graylog server.

## Context
The documentation [states](http://docs.graylog.org/en/2.4/pages/sending_data.html#syslog) that:
> Graylog is able to accept and parse RFC 5424...

But unfortunately, it is not able to parse even the example line from the mentioned RFC.

* Graylog Version: graylog:2.4.0-1
* Elasticsearch Version: elasticsearch:5.6.2
* MongoDB Version: mongo:3
* Operating System: Debian Stable
* Browser version: Firefox ESR 52.7.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.