go-syslog icon indicating copy to clipboard operation
go-syslog copied to clipboard

Published 20 hours ago • verified publisher icon influxdata

Unable to use rfc3164 (BSD syslog) parser in combination with nontransparent or octet-counted parsers

Open Minnozz opened this issue 5 years ago • 1 comments

I'm trying to parse messages from rsyslog's owfwd module. rsyslog uses BSD syslog messages (RFC 3164). However, the two parsers that can handle reading multiple syslog messages from a stream, nontransparent and octetcounting, both assume RFC 5424 style syslog messages.

Is it possible to add parsing multiple BSD-style syslog messages (with both framing methods) as well?

rsyslog documentation: https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html#tcp-framing

Minnozz avatar Apr 28 '20 15:04 Minnozz

@Minnozz thanks for the issue. I'm not a syslog expert, but maybe @leodido or @goller knows?

russorat avatar May 08 '20 16:05 russorat