UTMStack
UTMStack copied to clipboard
Improve RFC-compliant Syslog receiver with TCP/UDP and TLS support
Describe the feature
Implement a standards-compliant syslog message receiver that supports multiple transport protocols and framing methods according to IETF RFCs. The module should handle:
- Automatic framing detection (RFC 6587):
- Octet counting format
- Newline-delimited format
- Transport protocols:
- UDP (RFC 5426)
- TCP (RFC 6587)
- TLS over TCP (RFC 5425)
- Message validation per RFC 5424 size requirements (480-8192 bytes)
- Compatibility with both legacy (RFC 3164) and modern (RFC 5424) syslog formats
Use Case
Enterprise SIEM deployments need to:
- Receive logs from heterogeneous devices (Cisco, Fortinet, Palo Alto, Linux/Windows servers) using different syslog implementations
- Secure sensitive data in transit using TLS encryption
- Handle large messages reliably without fragmentation or data loss
- Reduce operational complexity through automatic format detection
Proposed Solution
No response
Other Information
No response
Acknowledgements
- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change