<div dir="auto"><div>Hi,</div><div dir="auto"><br></div><div dir="auto">Sorry I have trouble matching up the config with the log output. Please find some comments inline.</div><div dir="auto"><br></div><div dir="auto">Balázs<br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Fri, Aug 19, 2022, 16:47 John Law <<a href="mailto:JohnLaw@tfl.gov.uk">JohnLaw@tfl.gov.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
Hi,
<div><br>
</div>
<div>We have a number of network devices sending syslog traffic to syslog-ng OSE 3.25 installed on RHEL 7.9.</div>
<div><br>
</div>
<div>We are having an issue where multiple events are being written as the same line.</div>
<div><br>
</div>
<div>The config file is </div>
<div><br>
</div>
<div>template-function adm1 "${HOST} message-length=$(length \"${MSG}\") ${MESSAGE}\n";</div>
<div>source s_adm1 {</div>
<div> udp(ip(0.0.0.0) port(5527) );</div>
<div> tcp(ip(0.0.0.0) port(5527) );</div>
<div>};</div>
<div>destination d_adm1 {</div>
<div> file(</div>
<div> "/Data/syslog_data/$LOGHOST/$R_YEAR-$R_MONTH-$R_DAY/adm1/$HOST_FROM/$HOST/$FACILITY.local"</div>
<div> template("$(adm1-function)\n")</div></div></div></div></blockquote></div></div><div dir="auto"><br></div><div dir="auto">You only mention $(adm1) as a template function but this one refers to $(adm1-function)</div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote" dir="auto"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
<div> );</div>
<div>};</div>
<div>log { source(s_adm1); destination(d_adm1); flags(final); };</div>
<div><br>
</div>
<div><br>
</div>
<div>A small extract of one of the files is, naturally I have changed the IPs</div>
<div><br>
</div>
<div><br>
</div>
<div><a href="http://192.1.1.1/31181-" target="_blank" rel="noreferrer">192.1.1.1/31181-</a>><a href="http://192.1.3.1/135" target="_blank" rel="noreferrer">192.1.3.1/135</a> 0x0 source rule r12 N/A N/A 6 ACME-CNB010 ACME CNB 1727847 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN275 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created <a href="http://192.6.20.1/47250-" target="_blank" rel="noreferrer">192.6.20.1/47250-</a>><a href="http://192.104.20.1/443" target="_blank" rel="noreferrer">192.104.20.1/443</a>
0x0 junos-https <a href="http://192.6.20.1/47250-" target="_blank" rel="noreferrer">192.6.20.1/47250-</a>><a href="http://192.104.20.1/443" target="_blank" rel="noreferrer">192.104.20.1/443</a> 0x0 N/A N/A N/A N/A 6 ACME-BWC002 ACME BWC_EDESIX_AWS 917879 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN275 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created</div><div dir="auto"></div></div></div></div></blockquote></div></div><div dir="auto"><br></div><div dir="auto">Can you show me the lines intermixed here? Again this does not seem to have been formatted with $(adm1) at least as defined above.</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote" dir="auto"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif"><div dir="auto"> <a href="http://192.6.20.1/47252-" target="_blank" rel="noreferrer">192.6.20.1/47252-</a>><a href="http://192.104.20.1/443" target="_blank" rel="noreferrer">192.104.20.1/443</a>
0x0 junos-https <a href="http://192.6.20.1/47252-" target="_blank" rel="noreferrer">192.6.20.1/47252-</a>><a href="http://192.104.20.1/443" target="_blank" rel="noreferrer">192.104.20.1/443</a> 0x0 N/A N/A N/A N/A 6 ACME-BWC002 ACME BWC_EDESIX_AWS 595069 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN285 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created <a href="http://192.1.57.1/54205-" target="_blank" rel="noreferrer">192.1.57.1/54205-</a>><a href="http://192.1.7.1/137" target="_blank" rel="noreferrer">192.1.7.1/137</a>
0x0 junos-nbname <a href="http://192.1.57.1/54205-" target="_blank" rel="noreferrer">192.1.57.1/54205-</a>><a href="http://192.1.7.1/137" target="_blank" rel="noreferrer">192.1.7.1/137</a> 0x0 N/A N/A N/A N/A 17 ACME-COMP007 ACME CCA 1735324 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN288 <14>Aug 19 11:38:50 sunny-fwl29 RT_FLOW: RT_FLOW_SESSION_CREATE: session created <a href="http://192.1.57.1/62486-" target="_blank" rel="noreferrer">192.1.57.1/62486-</a>><a href="http://192.1.7.1/135" target="_blank" rel="noreferrer">192.1.7.1/135</a>
0x0 junos-ms-rpc-tcp <a href="http://192.1.57.1/62486-" target="_blank" rel="noreferrer">192.1.57.1/62486-</a>><a href="http://192.1.7.1/135" target="_blank" rel="noreferrer">192.1.7.1/135</a> 0x0 N/A N/A N/A N/A 6 ACME-COMP007 ACME CCA 1027474 N/A(N/A) reth3.860 UNKNOWN UNKNOWN UNKNOWN249</div>
<div><br>
</div>
I suspect it might be something to do with the amount of logs that are received in very quick succession, but I have no idea how to address this. One thing I have noticed is that it always appears to be the same device that is causing the issue. When I look
at other devices coming in on the same port, they appear to write out correctly.<br>
</div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
<br>
</div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
Any suggestion would be really welcome.</div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
<br>
</div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
Thanks</div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
<br>
</div>
<div class="MsoNormal" style="margin:0px 0cm;font-size:11pt;font-family:Calibri,sans-serif">
John</div>
</div>
<br><br>
<p align="center"><font style="BACKGROUND-COLOR:#ffffff">This message has been scanned for malware by Forcepoint. </font><a href="http://www.forcepoint.com/" target="_blank" rel="noreferrer"><font style="BACKGROUND-COLOR:#ffffff" color="#000000">www.forcepoint.com</font></a></p>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div></div></div>