<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Yes, there is a flag "syslog-protocol"
that will allow this. The rfc5124 only applies to TCP, so the flag</div>
<div class="moz-cite-prefix">is only on the tcp source.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Our configuration for the source is</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">source s_network_udp {<br>
network(localip(1.2.3.4) port(514) so_rcvbuf(33554432)
log_fetch_limit(20000) log_iw_size(1000000) transport("udp")
tags("unix_network") flags(no-multi-line) );<br>
};<br>
source s_network_tcp {<br>
network(localip(1.2.3.4) port(514) max_connections(5000)
log_fetch_limit(20000) log_iw_size(1000000) transport("tcp")
flags(no-multi-line,syslog-protocol) tags("unix_network") );<br>
};<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Hope that helps.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Evan.<br>
</div>
<br>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 2/23/19 5:07 PM, Carlan Philippe
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:1313969407.6661190.1550970421020@mail.yahoo.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="yahoo-style-wrap" style="font-family:Helvetica Neue,
Helvetica, Arial, sans-serif;font-size:13px;">
<div>Hi all, </div>
<div><br>
</div>
<div>Is there a way to configure syslog-ng to process properly
both <span>RFC3164 and RFC5124 on the same listening port ? </span></div>
<div><br>
</div>
<div>The scenario is a bunch of devices sending traffic to one
syslog server port (both udp + tcp) with the senders typically
not knowing what protocol they are sending. </div>
<div><br>
</div>
<div>We are running syslog-ng 3.13 with this setup: </div>
<div><br>
</div>
<div>source s_syslog { udp(ip(0.0.0.0) port(514)) ; </div>
<div> tcp(ip(0.0.0.0) port(514)); }</div>
<div><br>
</div>
<div><br>
</div>
<div> If needed we could upgrade syslog-ng to 3.19.1 but having
checked the doc for 3.19, it seems that the solution would be
to create 2 source entries, 1 for RFC3164 with network() and 1
for RFC5124 with syslog(). Neverthless, these 2 sources
would have to listen on *different* ports and that is the
problem for us.</div>
<div><br>
</div>
<div>Note that we also have an identical issue with cisco
traffic, since it's not RFC compliant, syslog-ng adds
automatically a header with timestamp and hostname. </div>
</div>
</blockquote>
<br>
</body>
</html>