Uploaded image for project: 'Spring XD'
  1. Spring XD
  2. XD-2425

SpringXD's syslog source does not fully support syslog RFC5424

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Done
    • Priority: Minor
    • Resolution: Complete
    • Affects Version/s: 1.1 M1
    • Fix Version/s: 1.1 GA
    • Component/s: Ingest
    • Labels:
    • Story Points:
      5
    • Rank (Obsolete):
      89
    • Sprint:
      Sprint 40

      Description

      SpringXD's syslog source cannot parse rfc5424 messages into a Map.
      For the messages we get in RFC 3164, springXD converts these to a Map.

      Since the rfc5424 data cannot be interpreted then the map contains just one key called 'UNDECODED'.
      The result of this is that we get a string that looks like this (when we convert the message to a String)

       {UNDECODED=<182>Dec 02 2014 07:56:35: %ASA-6-113008: AAA transaction status ACCEPT : user = jbloggs}
      

      Should be something like this (note the values below are for illustrative purposes only and should not be used as test data)

       {FACILITY=22, SEVERITY=6, TIMESTAMP=Tue Dec 02 07:56:35, HOST=the-hostname-that-sent-the-data, TAG=%ASA-6-113008, MESSAGE=........}
      

      Root Cause

      Spring integration does not parse these messages. There is a JIRA for SI here:
      https://jira.spring.io/browse/INT-3450

        Attachments

          Activity

            People

            Assignee:
            grussell Gary Russell
            Reporter:
            dokeeffe Derek OKeeffe
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: