Graylog2 / Graylog2/graylog2-server
Syslog Format vom syslog-ng 2.0.9 is not parsed correctly
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
I have a fresh Graylog 3.2 installation and try to forward my Log Messages into Graylog.
All messages that i deliver from rsyslog are corretly paresed but the messages form syslog-ng are wrong.
## Expected Behavior
I woud expect (message field):
syslog-ng shutting down; version='2.0.9'
(application_name field):
syslog-ng
This beavior i can see on messages from RSYSLOG with "RSYSLOG_SyslogProtocol23Format"
But not on messages from syslog-ng 2.0.9
I beleve the message from syslog-ng ist rfc3164 and this format is not correctly parsed.
While rsyslog sinds in rfc2454 format that is correctly parsed.
I've started a netcat to view the Message. It Looks like this:
`
SYSLOG-NG:
<45>Feb 5 12:28:49 ShortSysName syslog-ng[23778]: syslog-ng starting up; version='2.0.9'
<6>Feb 5 12:28:54 ShortSysName kernel: klogd 1.4.1, log source = /proc/kmsg started.
<6>Feb 5 12:29:09 ShortSysName kernel: Kernel logging (proc) stopped.
<6>Feb 5 12:29:09 ShortSysName kernel: Kernel log daemon terminating.
<46>Feb 5 12:29:09 ShortSysName syslog-ng[23778]: Termination requested via signal, terminating;
<45>Feb 5 12:29:09 ShortSysName syslog-ng[23778]: syslog-ng shutting down; version='2.0.9'
RSYSLOG:
<85>1 2020-02-05T12:30:24.849717+01:00 system.xxxx.local sudo - - - nagios : TTY=unknown ; PWD=/ ; USER=xyz ; COMMAND=/etc/nagios/zce/check_jstat.bash -g
`
So I think this is complient to the RFC Spec and sould be parsed correct. I would expect not to see the System name in the message field for syslog-ng and the application_name field to be set from default syslog_udp input.
## Current Behavior
From syslog-ng messages I have the message like this:
ShortSysName syslog-ng[23834]: syslog-ng shutting down; version='2.0.9'
## Possible Solution
## Steps to Reproduce (for bugs)
1. use syslog-ng 2.0.9 with this config
``
destination logserver { udp("xxx.xxx.xxx.xxx" port(514) ); };
log { source(src); destination(logserver); };
``
2. Create a input with syslog_udp
3. Review the message field
## Context
## Your Environment
* Graylog Version: Graylog 3.1.4+1149fe1
* Elasticsearch Version: elasticsearch 5.6.16
* MongoDB Version: 1:3.6.3-0ubuntu1.1
* Operating System: (Ubuntu 18.0.4 on Linux 4.15.0-66-generic)
* Browser version: Google Chrome 79
Contributor guide
Assessment
This issue has not been assessed yet.