<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
I see, so it's not an issue, but a request to be able to disable SDATA?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I've opened a feature request on Github [1], to be able to disable the sequenceId generation into SDATA, but not the whole SDATA.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
It has to be refined first, as I see it dangerous to disable SDATA usage on dest. side in case multiple sources connectet to the destination and some of them have received information in SDATA.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[1] <a href="https://github.com/syslog-ng/syslog-ng/issues/3036" id="LPNoLP717342">https://github.com/syslog-ng/syslog-ng/issues/3036</a></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Regards,<br>
Gabor</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Debjyoti Mukherjee <debmukhra@gmail.com><br>
<b>Sent:</b> Tuesday, December 3, 2019 11:06<br>
<b>To:</b> Gabor Nagy (gnagy) <Gabor.Nagy@oneidentity.com><br>
<b>Cc:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] Structure data set to "-"</font>
<div> </div>
</div>
<div>
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">Hello Gabor,
<div>Thanks for the information.</div>
<div><br>
</div>
<div>There was no issue in the server side. As RFC 5424 suggested this field can be NULL, I was wondering how to set this to "-" in syslog-ng</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Fri, Nov 29, 2019 at 9:57 PM Gabor Nagy (gnagy) <<a href="mailto:Gabor.Nagy@oneidentity.com">Gabor.Nagy@oneidentity.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Thanks for the information.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
There is no configuration option to disable automatic sequenceID generation into SDATA or to disable using SDATA when syslog() destination or the "syslog-protocol" flag is used.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
In case of local sources, like file(), unix-dgram() or the system() source (except where systemd is used) the sequenceID is automatically added, as stated before.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
I've checked for workarounds, but haven't found a good one:<br>
<ul>
<li>unset() rewrite rule won't work, as in this case the sequenceID is generated on destination side,</li><li>using a custom RFC5424-like template(), where the SDATA is replaced with a literal "-" won't work either, as in case of syslog() or network(... flags(syslog-protocol)), the "frame" of RFC5424 is automatically<br>
added to the outgoing message.<br>
</li></ul>
<div>The only way this can be done if a simple TCP destination is used, with the above mentioned custom RFC5424-like template, but the source on the server side has to be changed to a simple TCP source as well.</div>
<div><br>
</div>
<div><br>
</div>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt">I've found some discussion about the future of SEQNUM, which is slightly connected to this:</span><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsyslog-ng%2Fsyslog-ng%2Fissues%2F2152&data=02%7C01%7CGabor.Nagy%40oneidentity.com%7Cb0f9ec4ea0554da314fe08d777d87abb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637109643970279044&sdata=oVqUn9RuaOjNUz1N3KU9bHpuzv9xQJ0YAvtLw9%2BSQpw%3D&reserved=0" originalsrc="https://github.com/syslog-ng/syslog-ng/issues/2152" shash="vKrhbIKhGRfAK/5/tcdKuZjO70s2nxNdDLkQxrcrKC3/KRvRFQSY9SXP2NOnMvqXpZ/5n1x2kqbKUBz5h/6p0Yeq8gqxeGoh5HdmWoJvvgbHyVIzJuAH2pqB1udY5YPrxrAcAVdn6HALiu+6JZxcwTKB+UGRiymhMudUHl03Ng0=" id="x_gmail-m_1349895980142592142LPNoLP934540" target="_blank">https://github.com/syslog-ng/syslog-ng/issues/2152</a><br>
> 3. <span style="color:rgb(36,41,46); font-size:14px; text-align:left; background-color:rgb(255,255,255); display:inline">drop SEQNUM support, as noone cares. Be able to extract it from log messages, but leave it in a name-value pair (e.g. .cisco.seq_num),
and nothing else. Never generate it on output.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Just out of interest, can you explain to me what kind of problem is caused by sequenceId on server side?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Maybe we can filter, or opt out the sequenceId on the server side (as syslog() source on the server side will parse it, there it can be removed with a rewrite rule).</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Regards,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Gabor</div>
<br>
<div id="x_gmail-m_1349895980142592142appendonsend"></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_1349895980142592142divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
on behalf of Debjyoti Mukherjee <<a href="mailto:debmukhra@gmail.com" target="_blank">debmukhra@gmail.com</a>><br>
<b>Sent:</b> Friday, November 29, 2019 11:30<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Structure data set to "-"</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156); width:100%; border-style:solid; border-color:rgb(156,101,0); border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:Calibri; color:black; text-align:left">
<span style="color:rgb(156,101,0); font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">Configuration is simple with default config only I have added a destination syslog () to send to UDP remote host listening on 514 port</div>
<br>
<div>
<div dir="ltr">On Wed, Nov 27, 2019 at 7:11 PM Gabor Nagy (gnagy) <<a href="mailto:Gabor.Nagy@oneidentity.com" target="_blank">Gabor.Nagy@oneidentity.com</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Hello,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Syslog-ng does not always put the sequenceId into SDATA, for example logs from a local file will have a seqnum and when forwarded it will have this SDATA field.<br>
More info about this can be found under SEQNUM macro in our admin guide:<br>
<a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.syslog-ng.com%2Ftechnical-documents%2Fdoc%2Fsyslog-ng-open-source-edition%2F3.24%2Fadministration-guide%2F63%23TOPIC-1298112&data=02%7C01%7CGabor.Nagy%40oneidentity.com%7Cb0f9ec4ea0554da314fe08d777d87abb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637109643970279044&sdata=LArcotgaHHtP53M8FxcGyvy%2BQaQGjj284p2KKnxP3W8%3D&reserved=0" originalsrc="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.24/administration-guide/63#TOPIC-1298112" shash="Xbbf/r7QeNMGKc2LA6MkGKbHqGZp6293mlfkE3I205ayuny84IK9C+sRAaIUtaaBdLI+xQa62Cd7k5OeAqcY8ZSuZq4rz0JHmxXMfAMq4QoTOKvldPG/bTDRue95ASBubsgw2tGBw0V6/GxS7VLU2z0QVIJiRTZmpGSxrf0KIhM=" id="x_gmail-m_1349895980142592142x_gmail-m_3470920806590748091LPNoLP630292" target="_blank">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.24/administration-guide/63#TOPIC-1298112</a><br>
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Well, I don't know a quick solution (e.g. a config option to disable this), I'll try to help you.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt">Can you share your configuration, please?</span><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt"><br>
Regards,<br>
Gabor</span></div>
<div id="x_gmail-m_1349895980142592142x_gmail-m_3470920806590748091appendonsend">
</div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_1349895980142592142x_gmail-m_3470920806590748091divRplyFwdMsg" dir="ltr">
<font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Debjyoti Mukherjee <<a href="mailto:debmukhra@gmail.com" target="_blank">debmukhra@gmail.com</a>><br>
<b>Sent:</b> Tuesday, November 26, 2019 16:17<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] Structure data set to "-"</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156); width:100%; border-style:solid; border-color:rgb(156,101,0); border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:Calibri; color:black; text-align:left">
<span style="color:rgb(156,101,0); font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">Hello
<div><br>
</div>
<div>Trying to send logs to remote syslog server in RFC 5424 format. The STRUCTURE_DATA should be set to "-".</div>
<div><br>
</div>
<div>What is the way to the this value to "-"</div>
<div><br>
</div>
<div>Currently it is coming as [meta sequenceId="21"]. I am using Openwrt and the syslog version is 3.24</div>
<div><br>
</div>
<div>Thank you</div>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7CGabor.Nagy%40oneidentity.com%7Cb0f9ec4ea0554da314fe08d777d87abb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637109643970289032&sdata=SxyLoZoZ1%2Frw67u%2F4pdhscuQXur3dLawHC%2BLyrjot0k%3D&reserved=0" originalsrc="https://lists.balabit.hu/mailman/listinfo/syslog-ng" shash="wahWUbm7vOEE6FK09D5kCgmEzjX989nobuesKk44K8589Bm3SDhwfooWFr6xdWiE8Q+1CVb8ttLUgpbv2hyOEgUn+3H0Slbows5/DKX230zn4JWrO12LDWckLxsY2dXUiQK1pZ8SCD3+ObjaQLDys6lpkCXp6WVAYWLOu9qUEJw=" rel="noreferrer" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7CGabor.Nagy%40oneidentity.com%7Cb0f9ec4ea0554da314fe08d777d87abb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637109643970289032&sdata=AbOKRY83TkAp3amdM7r4wehvQpQGESX1cm29FNO2y0o%3D&reserved=0" originalsrc="http://www.balabit.com/support/documentation/?product=syslog-ng" shash="Xe4qTgAOBFxWKJWi9ZrMj2IQ4GcYT9MIUrtKw48WS5NjQVWr7JLLJ58IMZPoeEbiIZZGHTXM8EjgXM6stq+iYMNxJnb4d+9z7rd2KCokte85OhAtv9S4alGFsyrwlaa7Y38xqUHM6Fj9CUcqkjQ+vrgziX7AfPyDadhs3UZjkNw=" rel="noreferrer" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7CGabor.Nagy%40oneidentity.com%7Cb0f9ec4ea0554da314fe08d777d87abb%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637109643970299031&sdata=W3QkHeM0I3ccu%2FLlB3x65qp907cVOY%2BOmp4c7yZ4Gn8%3D&reserved=0" originalsrc="http://www.balabit.com/wiki/syslog-ng-faq" shash="NXWukao14kRlX4QPa80XBgennWCwpu9CJ0vlvSXYjx36uOC1haY6Z6SCHf+gQNkOEU5jpsMh2JZ5IKy0wvTB8uR6c56I3JdemEeGAjB3AyT1NmRGdTJLfOhKBj7MJ4A/NozL2ECRCga0A3NreHzUOFoZ0kal+Dzfe1HAW4f/t3I=" rel="noreferrer" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>