On Tue, Jun 3, 2014 at 2:11 PM, Duarte Silva <[email protected]> wrote:
> On Tuesday 03 June 2014 13:18:28 Rainer Gerhards wrote: > > On Tue, Jun 3, 2014 at 1:01 PM, Duarte Silva < > [email protected]> > > > > wrote: > > > Hi David, > > > > > > thanks for the tip. I can now understand what Rsyslog is doing when it > > > receives the data :) > > > > > > Since the appliance is sending the JSON in a multi-line format, the > last > > > line > > > isn't being interpreted as the message, but rather it's being > interpreted > > > as > > > all the other fields. > > > > > > Since I can't modify the way the appliance sends the logs, is there a > way > > > in > > > Rsyslog to get around this? > > > > Which protocol is used? Can you post a sample of the data **as seen on > the > > wire**? > > Quoting: > > > > > In tcpdump I clearly see the full message arriving: > > > > > > > > # tcpdump -A -n -vvv -s2048 -i eth0 "tcp port 514" > > > > (...) > > > > =.2.....<164>appliance-892.alert: { > > > > > > > > "alert": { > > > > > > > > "action": "notified", > > > > "explanation": "something" > > > > }, > > > > "id": "892", > > > > "occurred": "2014-06-02T15:00:24Z", > > > > > > > > }, > > > > "appliance": "appliance", > > > > "product": "product", > > > > "version": "version" > > > > > > > > } > > > > . > > > > > > So this is exactly what you see (not pretty-printed)? So it starts with: <164>appliance-892.alert: {<LF>"alert": {<LF>"action": "notified",<LF>... <LF> being US-ASCII LF If so, that appliance is sending horribly malformed messages with a totally invalid framing. Honestly, I have no idea at all how a heuristic could combine those lines. What do they say what the framing is (in other words: how to know when the message is finished and the next one starts)? In any case, it's not syslog protocol. See RFC5424 or even 3164 and you'll see that this is something totally different. Among others, I'd **strongly** suggest to file a bug report with them. If you can get the information out of them how to know message borders, I may be able to implement their "protocol", but that will be a custom project (aka needs a sponsor). Sorry I have no better response. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
