Graylog2 / Graylog2/graylog2-server

Syslog Format vom syslog-ng 2.0.9 is not parsed correctly

Open
#7,398 5 comments 1 reaction 0 assignees View on GitHub
to-verify
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I have a fresh Graylog 3.2 installation and try to forward my Log Messages into Graylog.
All messages that i deliver from rsyslog are corretly paresed but the messages form syslog-ng are wrong.

## Expected Behavior

I woud expect (message field):
syslog-ng shutting down; version='2.0.9'
(application_name field):
syslog-ng

This beavior i can see on messages from RSYSLOG with "RSYSLOG_SyslogProtocol23Format"
But not on messages from syslog-ng 2.0.9

I beleve the message from syslog-ng ist rfc3164 and this format is not correctly parsed.
While rsyslog sinds in rfc2454 format that is correctly parsed.

I've started a netcat to view the Message. It Looks like this:
`
SYSLOG-NG:
<45>Feb 5 12:28:49 ShortSysName syslog-ng[23778]: syslog-ng starting up; version='2.0.9'
<6>Feb 5 12:28:54 ShortSysName kernel: klogd 1.4.1, log source = /proc/kmsg started.
<6>Feb 5 12:29:09 ShortSysName kernel: Kernel logging (proc) stopped.
<6>Feb 5 12:29:09 ShortSysName kernel: Kernel log daemon terminating.
<46>Feb 5 12:29:09 ShortSysName syslog-ng[23778]: Termination requested via signal, terminating;
<45>Feb 5 12:29:09 ShortSysName syslog-ng[23778]: syslog-ng shutting down; version='2.0.9'

RSYSLOG:
<85>1 2020-02-05T12:30:24.849717+01:00 system.xxxx.local sudo - - - nagios : TTY=unknown ; PWD=/ ; USER=xyz ; COMMAND=/etc/nagios/zce/check_jstat.bash -g
`

So I think this is complient to the RFC Spec and sould be parsed correct. I would expect not to see the System name in the message field for syslog-ng and the application_name field to be set from default syslog_udp input.

## Current Behavior

From syslog-ng messages I have the message like this:
ShortSysName syslog-ng[23834]: syslog-ng shutting down; version='2.0.9'

## Possible Solution

## Steps to Reproduce (for bugs)

1. use syslog-ng 2.0.9 with this config

``

destination logserver { udp("xxx.xxx.xxx.xxx" port(514) ); };
log { source(src); destination(logserver); };

``

2. Create a input with syslog_udp
3. Review the message field

## Context

## Your Environment

* Graylog Version: Graylog 3.1.4+1149fe1
* Elasticsearch Version: elasticsearch 5.6.16
* MongoDB Version: 1:3.6.3-0ubuntu1.1
* Operating System: (Ubuntu 18.0.4 on Linux 4.15.0-66-generic)
* Browser version: Google Chrome 79

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.