On Tue, Jun 3, 2014 at 2:43 PM, Duarte Silva <[email protected]> wrote:
> On Tuesday 03 June 2014 14:20:33 Rainer Gerhards wrote: > > On Tue, Jun 3, 2014 at 2:11 PM, Duarte Silva < > [email protected]> > > > > wrote: > > > On Tuesday 03 June 2014 13:18:28 Rainer Gerhards wrote: > > > > On Tue, Jun 3, 2014 at 1:01 PM, Duarte Silva < > > > > > > [email protected]> > > > > > > > wrote: > > > > > Hi David, > > > > > > > > > > thanks for the tip. I can now understand what Rsyslog is doing > when it > > > > > receives the data :) > > > > > > > > > > Since the appliance is sending the JSON in a multi-line format, the > > > > > > last > > > > > > > > line > > > > > isn't being interpreted as the message, but rather it's being > > > > > > interpreted > > > > > > > > as > > > > > all the other fields. > > > > > > > > > > Since I can't modify the way the appliance sends the logs, is > there a > > > > > > way > > > > > > > > in > > > > > Rsyslog to get around this? > > > > > > > > Which protocol is used? Can you post a sample of the data **as seen > on > > > > > > the > > > > > > > wire**? > > > > > > Quoting: > > > > > > In tcpdump I clearly see the full message arriving: > > > > > > > > > > > > # tcpdump -A -n -vvv -s2048 -i eth0 "tcp port 514" > > > > > > (...) > > > > > > =.2.....<164>appliance-892.alert: { > > > > > > > > > > > > "alert": { > > > > > > > > > > > > "action": "notified", > > > > > > "explanation": "something" > > > > > > }, > > > > > > "id": "892", > > > > > > "occurred": "2014-06-02T15:00:24Z", > > > > > > > > > > > > }, > > > > > > "appliance": "appliance", > > > > > > "product": "product", > > > > > > "version": "version" > > > > > > > > > > > > } > > > > > > . > > > > So this is exactly what you see (not pretty-printed)? So it starts with: > > > > <164>appliance-892.alert: {<LF>"alert": {<LF>"action": "notified",<LF>... > > > > <LF> being US-ASCII LF > > Yes, that is how it arrives. > > > > > If so, that appliance is sending horribly malformed messages with a > totally > > invalid framing. Honestly, I have no idea at all how a heuristic could > > combine those lines. What do they say what the framing is (in other > words: > > how to know when the message is finished and the next one starts)? > > > > In any case, it's not syslog protocol. See RFC5424 or even 3164 and > you'll > > see that this is something totally different. Among others, I'd > > **strongly** suggest to file a bug report with them. > > > > If you can get the information out of them how to know message borders, I > > may be able to implement their "protocol", but that will be a custom > > project (aka needs a sponsor). > > From the appliance configuration, they are using syslog only as a > transport for > the messages. This is **not** syslog transport. See the RFCs I quoted. It's something they invented. Rainer > The messages can then be XML or JSON. I don't think I will have > any luck in trying to swing the appliance maker to make the messages a one > liner. I will try to home brew something out. > > Thanks anyway, > Duarte > > > Sorry I have no better response. > > > > Rainer > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
