-
Notifications
You must be signed in to change notification settings - Fork 468
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Writing a null character at the end of TCP payload #206
Comments
Instead of |
In the long run, we'll have proper gelf support (which would be more than just |
I agree with $(litteral "x0"), it seems good to me. |
Right. This is going to be harder than it first seemed, because even if we manage to append a NULL character to the string, and the GString's length is correct too, we end up using So To be able to implement this feature, we need to teach templates to handle embedded NULLs. |
As far as I saw, the problem is that the parser eliminates the NULL character. If the compiled template somehow contains the NULL character it will be contained in the formatted template's result. |
Custom byte sequences can be appended to the formatted template with this function the parameter of this template function is a space separated byte sequence. The bytes can be hexadecimal (0x..) octal (0...) and decimal formatted. e.g.: $(literal "0xFE 0222 42"). NULL character can be also set. Fixes syslog-ng#206 Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com>
This new template function makes it possible to inject binary data to the output of a template. Parameters are a list of unsigned 8 bit numbers that are converted to characters and produced as output. The bytes can be hexadecimal (0x prefix) octal (0 prefix) and decimal formatted (no prefix). For example: $(binary 0xFE 0222 42). Please note that binary characters, especially the NUL character (0x00) may not be handled properly by the driver that uses the produced output. LogWriter based destinations (such as file, tcp and other socket socket based destinations) should be OK though. Fixes #206 Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com> Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
This new template function makes it possible to inject binary data to the output of a template. Parameters are a list of unsigned 8 bit numbers that are converted to characters and produced as output. The bytes can be hexadecimal (0x prefix) octal (0 prefix) and decimal formatted (no prefix). For example: $(binary 0xFE 0222 42). Please note that binary characters, especially the NUL character (0x00) may not be handled properly by the driver that uses the produced output. LogWriter based destinations (such as file, tcp and other socket socket based destinations) should be OK though. Fixes #206 Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com> Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
readme: fix APT repo commands
I need to send a null character at the end of a message on a tcp output...
But this null is considered to be an end of string.
My use case is sending a GELF message to a graylog's tcp input.
GELF message is a json syntax quite simple to comply with thanks to format-json.
Graylog needs a null character at the end of a GELF message in TCP but not in UDP.
I tried many combination in the template with \x0, echo \x0,
global_definition_of_null
, etc...The matter is that null character when interpreted is an end of string, and is not written in the tcp message.
I see truncated messages with ngrep.
Gelf Specification is not clear about it, but I have tested it
After finding a clue in Graylog's issues
In syslog-ng's mailling list, we have seen three options with Balazs Scheidler and Gergely Nagy :
of format-json
A format-gelf as in 1 is missing, but my case and other may be satisfied with a template function that writes raw characters as in solution 3
The text was updated successfully, but these errors were encountered: