<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="WordSection1">
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Hi,
<div><br>
</div>
<div>We have a number of network devices sending syslog traffic to syslog-ng OSE 3.25 installed on RHEL 7.9.</div>
<div><br>
</div>
<div>We are having an issue where multiple events are being written as the same line.</div>
<div><br>
</div>
<div>The config file is </div>
<div><br>
</div>
<div>template-function adm1 "${HOST} message-length=$(length \"${MSG}\") ${MESSAGE}\n";</div>
<div>source s_adm1 {</div>
<div> udp(ip(0.0.0.0) port(5527) );</div>
<div> tcp(ip(0.0.0.0) port(5527) );</div>
<div>};</div>
<div>destination d_adm1 {</div>
<div> file(</div>
<div> "/Data/syslog_data/$LOGHOST/$R_YEAR-$R_MONTH-$R_DAY/adm1/$HOST_FROM/$HOST/$FACILITY.local"</div>
<div> template("$(adm1-function)\n")</div>
<div> );</div>
<div>};</div>
<div>log { source(s_adm1); destination(d_adm1); flags(final); };</div>
<div><br>
</div>
<div><br>
</div>
<div>A small extract of one of the files is, naturally I have changed the IPs</div>
<div><br>
</div>
<div><br>
</div>
<div>192.1.1.1/31181->192.1.3.1/135 0x0 source rule r12 N/A N/A 6 ACME-CNB010 ACME CNB 1727847 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN275 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.6.20.1/47250->192.104.20.1/443
0x0 junos-https 192.6.20.1/47250->192.104.20.1/443 0x0 N/A N/A N/A N/A 6 ACME-BWC002 ACME BWC_EDESIX_AWS 917879 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN275 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.6.20.1/47252->192.104.20.1/443
0x0 junos-https 192.6.20.1/47252->192.104.20.1/443 0x0 N/A N/A N/A N/A 6 ACME-BWC002 ACME BWC_EDESIX_AWS 595069 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN285 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.1.57.1/54205->192.1.7.1/137
0x0 junos-nbname 192.1.57.1/54205->192.1.7.1/137 0x0 N/A N/A N/A N/A 17 ACME-COMP007 ACME CCA 1735324 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN288 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.1.57.1/62486->192.1.7.1/135
0x0 junos-ms-rpc-tcp 192.1.57.1/62486->192.1.7.1/135 0x0 N/A N/A N/A N/A 6 ACME-COMP007 ACME CCA 1027474 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN249</div>
<div><br>
</div>
I suspect it might be something to do with the amount of logs that are received in very quick succession, but I have no idea how to address this. One thing I have noticed is that it always appears to be the same device that is causing the issue. When I look
at other devices coming in on the same port, they appear to write out correctly.<br>
</div>
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
</div>
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Any suggestion would be really welcome.</div>
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
</div>
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
Thanks</div>
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
</div>
<div class="MsoNormal elementToProof" style="margin: 0px 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
John</div>
</div>
<br><br>
<P align=center><FONT style="BACKGROUND-COLOR: #ffffff">This message has been scanned for malware by Forcepoint. </FONT><A href="http://www.forcepoint.com/"><FONT style="BACKGROUND-COLOR: #ffffff" color=#000000>www.forcepoint.com</FONT></A></P>
</body>
</html>