elastic / elastic/integrations

ssi_some: data corruption in TCP/Syslog/Unix input

Open
#16,084 10 comments 0 reactions 0 assignees View on GitHub
bug discuss Integration:checkpoint Integration:cisco_asa Integration:cisco_ios Integration:f5_bigip Integration:fortinet_fortigate Integration:panw Integration:pfsense Integration:sophos Integration:syslog_router Integration:watchguard_firebox Team:Integration-Experience Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Summary

For Elastic Agent v9.2, in the TCP/Syslog/Unix input, while listening on the port, randomly messages become fragmented. Sometimes multiple messages are combined into one; other times, messages may be truncated at the beginning or end. ([Beats issue](https://github.com/elastic/beats/issues/47550))

To address this data corruption issue, a [PR](https://github.com/elastic/beats/pull/47618) was raised and merged. The fix will be available in version `9.2.2`. The affected versions are `9.2.0` and `9.2.1`; therefore, any integration using these inputs with these stack versions is also affected.

We should update the minimum required stack version to `9.2.2` once it becomes available. Or, in the meantime, we should add a note to the README of all affected integrations.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.