Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug RFC detection regex for syslog parser #2877

Closed
mlasevich opened this issue Mar 12, 2020 · 0 comments · Fixed by #2879
Closed

Bug RFC detection regex for syslog parser #2877

mlasevich opened this issue Mar 12, 2020 · 0 comments · Fixed by #2879

Comments

@mlasevich
Copy link

Check CONTRIBUTING guideline first and here is the list to help us investigate the problem.

Describe the bug
When RFC3164 formatted message contains '>' character followed by a number, it is incorrectly detected as RFC5425 message due to an issue with regex here

Simple fix is to make the detection regex match the parsing regex - i.e.
instead of

REGEXP_DETECT_RFC5424 = /^\<.*\>[1-9]\d{0,2}/

use this:

REGEXP_DETECT_RFC5424 = /^\<.[0-9]+\>[1-9]\d{0,2}/

To Reproduce

setup syslog parser plugin and run through it a message like:

    <15>Mar 12 21:58:53 localhost service: Connection established 1.2.3.4:1234<->4..2.1:4321

Expected behavior
Expected to be parsed as RFC3164 message:

{ 
 "pri": 15, 
 "time": "Mar 12 21:58:53", 
 "host": "localhost",
 "ident": "service", 
 "message": "Connection established 1.2.3.4:1234<->4..2.1:4321"
}

Actual behavior

Parser error due to attempt to parse it as RFC5424 message

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant