Graylog2 / Graylog2/graylog2-server

BSD Syslog from mikrotik not parsed

Open
#8,056 4 comments 1 reaction 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Hello, I need to receive logs from a Mikrotik router but found it does not work 100%.

There in an option in Mikrotik settings named 'bsd-syslog' which in their docs says "whether to use bsd-syslog as defined in RFC 3164".

## Expected Behavior

Receive 'bsd style' syslog messages without tweaking any further. That way Graylog could process the full message.

## Current Behavior
Messages are received only without 'bsd-syslog' setting. 'Allow overriding date' has to be enabled too, in Graylog's input.

Received messages don't have their information extracted automatically.

## Context

I've linked a pcap from the graylog server which show both kind of messages. The first two, are sent with 'bsd-syslog' and NOT received into graylog, last three are received ok but messages are saved into the full_message field only, nothing is extracted.
```
full_message
system,info,account mk_MDZi: user example logged out from 200.12.34.56 via winbox
```

Pcap: https://filebin.net/ardm8t32t26fevhy

Im learning about graylog, but without this, more work has to be done to process incoming messages.

## Your Environment

* Graylog Version: 3.2.4+a407287
* Elasticsearch Version: 6.8.8
* MongoDB Version: 3
* Operating System: Ubuntu amd64 / Docker

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.