On Tue, 3 Jun 2014, Duarte Silva wrote:
From the appliance configuration, they are using syslog only as a
transport for the messages. The messages can then be XML or JSON. I don't
think I will have any luck in trying to swing the appliance maker to make
the messages a one liner. I will try to home brew something out.
They may be using the syslog port, but this isn't syslog transport.
is this being sent of TCP or UDP? can you send us a short tcpdump of the
messages?
It can be sent over TCP or UDP (the example I gave was TCP, check the tcpdump
command line). Not really, sorry.
if UDP, are they sending one message per packet? or can one message span
multiple packets? if one message can span multiple packets, then they are in
deep trouble because UDP is unreliable delivery and packets can get lost or
arrive out of order.
Yes, one of the problems I noticed was that the UDP notification wasn't
contiguous (spanned throughout multiple packets), hence the switch to TCP in
the appliance configuration.
If this is TCP, then a parser module could read the stream and treat each
complete JSON object as a separate message. this would require a custom
module.
What appliance is this?
Malware related, their logging is crap (for example they don't even allow a
Rsyslsog server port change in the configuration).
wow this is broken. It would be nice to know the vendor name, so that we could
pass the word to avoid this vendor. Security devices that can't log sanely are a
major problem.
But this looks like something that could be dealt with using the tcp transport,
but it would be a custom input module.
Compared to what I'm sure you spent on the appliances, paying for a custom
module to receive these messages will be pretty cheap, talk with Rainer off
of the main list to get a quote for this. I've done it in the past. It's
much nicer to throw a little money at Adiscon and have it be part of the
core rsyslog than to hack something up and have to maintain it for future
versions.
I decided to drop Rsyslog and went to Logstash. Not using the appliance
Rsyslog notifications capabilities though. Used the appliance HTTP notifications
instead (sends a POST with the JSON encoded notification using CURL).
Ok, good luck.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
