0

Case 1:

For the below incoming message of syslog,

<14>Mar 22 11:12:06 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.2.3.4/62963->23.58.169.35/443 0x0 junos-https 6.7.8.9/32359->23.58.169.35/443 0x0 source rule 1 N/A N/A 6 1 Trust Untrust 60471 N/A(N/A) ge-0/0/1.0 UNKNOWN UNKNOWN UNKNOWN

syslog-ng successfully adds hostname between timestamp(Mar 22 11:12:06) and type of message(RT_FLOW)


Case 2:

But, for the below incoming message of syslog,

<14> Mar 22 11:04:17 206.133.74.126 03362 auth:  User 'sup_ogr' logged in from 206.133.74.127 to SSH session

peculiarly, IP address is already existing between timestamp(Mar 22 11:04:17) & type of message(auth).

syslog-ng is not able to add host name between time stamp and type of message

Configurations used are: use_dns (yes); & keep_hostname (yes);


1) In second case, does syslog message having IP, in compliance with RFC 5424 standards?

2) If yes, then, what configuration is required to set the host name, between time stamp & type of message?

1

I don't know exactly of syslog-ng, but I assume that it also uses a heuristic top parse legacy syslog messages, just like rsyslog (with a different heuristic, I guess).

It must be noted that the message format shown is strange. RFC3164 describes what usually can be seen on the wire, and the second format here is very far from what is described there. If possible, the best solution would be to have the sender fix the format to be more inline with standards.

1

Yes, both your messages resemble, but don't quite follow the syslog message format described in RFC3164. For details, see this and the following pages in the syslog-ng documentation. syslog-ng tries to parse these incorrect messages as well, but might fail to do so perfectly. You can try the following:

  • Check the sending host or application and see if you can tweak it to send properly formatted messages
  • It's possible that syslog-ng parses every field of the message, but not into the proper fields. You can try and check the values of the macros of these messages, and possibly create a template to properly format the messages
  • If all else fails, you can write a custom syslog-ng parser in Python to parse these log messages

HTH, Robert

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.