Testing log4j 1.17 socket appender, can only parse the first document

[ICHx]

Hi, I'm glad I found this library to experiment with.

I am using the library to try reading log4j logging event. I read the connection with bufio.NewReader then fed to jserial.NewSerializedObjectParser(r)

While single item worked well, if I am trying to send multiple events at once, ie. having 2 log.debug("Hello"); in the file below, it would fail to parse anything other than the first document.

logstash-input-log4j tester

I tried peeking it, while I have EOF error, it clearly still have data behind the EOF.

Here is the log.

2023/03/07 10:21:27 Peeked: [4 109 97 105 110 112 119 4 0 0 39 16 112 120 121]
2023/03/07 10:21:27 Error parsing object: [] error reading uint16: EOF
2023/03/07 10:21:27 Error peeking reader: EOF
2023/03/07 10:21:27 Peeked: []
2023/03/07 10:21:27 Received unserialized content:
 {"@":["AAAnEA==",null],"categoryName":"sender","class":{},"extends":{"org.apache.log4j.spi.LoggingEvent":{"@":["AAAnEA==",null],"categoryName":"sender","locationInfo":null,"mdcCopy":null,"mdcCopyLookupRequired":false,"ndc":null,"ndcLookupRequired":false,"renderedMessage":"Hello","threadName":"main","throwableInfo":null,"timeStamp":1678155687937}},"locationInfo":null,"mdcCopy":null,"mdcCopyLookupRequired":false,"ndc":null,"ndcLookupRequired":false,"renderedMessage":"Hello","threadName":"main","throwableInfo":null,"timeStamp":1678155687937}

[ICHx]

The code is here. https://github.com/ICHx/serialize_log4j_golang/blob/master/cmd/simple-service/main.go

Without hacky split: https://github.com/ICHx/serialize_log4j_golang/blob/5dc79a99cf51bcc09449007c1bba55a625cfab25/cmd/simple-service/main.go

[jkeys089]

@ICHx would it be possible to provide a minimal, self-contained reproducer? Unfortunately, I won't be able to investigate this week, but I'd be happy to help debug when I've got some time towards the end of next week.

[ICHx]

Sure, attached in the project there's a log generator, obtained from logstash's log4j-input https://github.com/ICHx/serialize_log4j_golang/tree/master/reference/log4jtest

I did a hexdump to create with my current hacky approach.

[jkeys089]

@ICHx I'm not 100% clear where I should be looking. Is this the example: https://github.com/ICHx/serialize_log4j_golang/blob/master/cmd/simple-service/main.go? If so, there is a lot going on there that is (I'm guessing) outside the scope of the example. If you could please provide a minimal reproducer (e.g. similar to tests in https://github.com/jkeys089/jserial/blob/master/deserialize_test.go) it would make things a bit easier for me to review.