syslog.cpp:251 (Received fewer fields than expected in line)

Bug report

What operating system and version are you using?

Different Linux OS platforms and versions
ubuntu (22.04.3 LTS, 22.04.04 LTS, 20.04.4 LSTS)
rhel (Red Hat Enterprise Linux release 8.6, 8.8, 8.9, 8.10)

What version of osquery are you using?

5.12.1

What steps did you take to reproduce the issue?

Have configured syslog event forwarding to osquery syslog_pipe using rsyslog.
One of the main log sources of syslog is Sysmon for Linux.

What did you expect to see?

No errors with syslog event collection

What did you see instead?

Errors indicating that some of events where not processed correctly from syslog_pipe by osquery:
E0725 10:40:16.960112 1217948 syslog.cpp:251] Received fewer fields than expected in line: d"">{00000000-0000-0000-0000-000000000000}<Data Name=""ParentProcessId"">137095<Data Name=""ParentImage"">-<Data Name=""ParentCommandLine"">-<Data Name=""ParentUser"">-"
E0725 10:40:23.173416 1217948 syslog.cpp:251] Received fewer fields than expected in line: d"">{00000000-0000-0000-0000-000000000000}<Data Name=""ParentProcessId"">3630<Data Name=""ParentImage"">-<Data Name=""ParentCommandLine"">-<Data Name=""ParentUser"">-"

At the same time most of sysmon events are processed correctly. We could not find difference in syslog_pipe between events that processed correctly and not.

Start in syslog.cpp around line 251 and reproduce the syslog_pipe forwarding setup with Sysmon for Linux on the reported Ubuntu or RHEL versions. Compare events that are processed correctly with those producing the fewer-fields error, then verify that affected events are collected without this error.