<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi,</div><div><br></div><div>in syslog-ng OSE 3.13 [1] we introduced a new feature, called app-parser [2] and the default network network driver is using it.</div><div>Maybe that could cause your issue.  If this is the case, then we have another PR [3] which makes it possible to disable the auto-parse (also part of 3.13).</div><div><br></div><div>Example: <br></div><div>source s_network {<br>  default-network-drivers(auto-parse(no));<br>};<br><br></div><div><table class="gmail-highlight gmail-tab-size gmail-js-file-line-container"><tbody><tr><td id="gmail-LC14" class="gmail-blob-code gmail-blob-code-inner gmail-js-file-line"></td></tr><tr></tr></tbody></table></div><div>If it not solves your problem then could you share the relevant part of your config?<br></div><div><br></div><div><br></div><div>[1] <a href="https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.13.1">https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.13.1</a><br></div><div>[2] <a href="https://github.com/balabit/syslog-ng/pull/1689">https://github.com/balabit/syslog-ng/pull/1689</a></div><div>[3] <a href="https://github.com/balabit/syslog-ng/pull/1788/">https://github.com/balabit/syslog-ng/pull/1788/</a><br></div><div><br></div><div><br></div><div>regards,</div><div>Laszlo Budai</div><div><br></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 7, 2018 at 6:00 PM, Nik Ambrosch <span dir="ltr"><<a href="mailto:nik@ambrosch.com" target="_blank">nik@ambrosch.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr">Recently I upgraded my centralized loghost from 3.9 -> 3.15 and I noticed that some of my cisco devices started being logged in an undesirable format... I don't want to enable the cisco parser because more than just cisco messages get delivered to this interface.  Here are the relevant fields that have changed before/after the upgrade:<br><br>syslog-ng 3.9, before upgrade ---<br>    ${FULLHOST}: "<a href="http://mydevice.com" target="_blank">mydevice.com</a>"<br>    ${PROGRAM}: ""<br>    message: "%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for..."<br><br>syslog-ng 3.15, before upgrade ---<br>    ${FULLHOST}: ":"<br>    ${PROGRAM}: "%CRYPTO-4-RECVD_PKT_INV_SPI"<br>    ${MSG}: "decaps: rec'd IPSEC packet has invalid spi for..."<br><br><br>Is this unintended behavior or a bug?  This particular device is a Cisco 3845 running ios 12.4(22)T4.<br><br>Thanks in advance.<br></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>