Graylog2 / Graylog2/graylog2-server

Graylog 3.1 CEF UDP regression

Open
#6,922 3 comments 0 reactions 0 assignees View on GitHub
to-verify
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Since migrate to Graylog 3.1, the CEF UDP input was unable to decode message (works fine in 2.4).

## Expected Behavior
Decode CEF Message from Checkpoint Firewall

`
CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|sqlnet1|Unknown|act=Drop deviceDirection=0 rt=1575387805000 spt=51690 dpt=1521 cs2Label=Rule Name layer_name=Prod_fw Security layer_uuid=927f269b-52dd-4cab-8550-7aeffda6ca02 match_id=4019 parent_rule=0 rule_action=Drop rule_uid=3e517596-1229-c34a-86e4-ab3a7f3ff752 ifname=bond1.45 logid=0 loguid={0x0,0x0,0x0,0x0} origin=10.254.4.203 originsicname=CN=fw,O=fw.net.m9ug26 sequencenum=292 version=5 dst=10.140.27.121 inzone=Internal outzone=Internal product=VPN-1 & FireWall-1 proto=6 service_id=sqlnet1 src=10.241.45.1
`

## Current Behavior
Error in decode process

`2019-12-03T16:52:09.226+01:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=dcf8ef90-15e4-11ea-b6a8-0050568a1266, journalOffset=-9223372036854775808, codec=CEF, payloadSize=19, timestamp=2019-12-03T15:52:09.225Z, remoteAddress=/10.145.24.247:38344}
java.lang.NullPointerException: null
at org.graylog.plugins.cef.parser.MappedMessage.(MappedMessage.java:37) ~[graylog.jar:?]
at org.graylog.plugins.cef.codec.CEFCodec.decodeCEF(CEFCodec.java:128) ~[graylog.jar:?]
at org.graylog.plugins.cef.codec.CEFCodec.decode(CEFCodec.java:117) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:86) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_222]`

## Steps to Reproduce (for bugs)

1.Add CEF input
2.send CEF message from Checkpoint Firewall log manager
3.Error in Graylog log (in 2.4 no error)

## Context

## Your Environment

* Graylog Version: 3.1.3
* Elasticsearch Version: 6.8.4
* MongoDB Version: 2.6.12-6.el7
* Operating System: CentOS 7.7
* Browser version: Chrome 71.0.3578.98

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.