bernd
commented
3 years ago We already support octet-count-framing in our TCP input. So we can probably re-use some of this for the CEF input.
Open patrickmann opened 3 years ago
bernd
commented
3 years ago We already support octet-count-framing in our TCP input. So we can probably re-use some of this for the CEF input.
GL Documentation states that we support both “Non-Transparent-Framing” and "octet-counting" mode for syslog. However, a CEF TCP input is not able to handle "octet-counting" mode: multiple messages appear to be parsed as a single, excessively long message, leading to confusing errors.
Customer scenario
Fortinet recommended enabling "enhanced logging," which switched the firewalls over to using the "reliable TCP" mode of transmission; this is an octet-counting CEF format. Our CEF input appeared to stop working with no good diagnostic information in the log file.
Customer impact
In the Fortinet scenario, customer was able to simply revert to using the previous format. However, CEF input was offline for a considerable amount of time while trouble-shooting the issue. Messages sent during this time were lost.
References
https://docs.graylog.org/en/4.0/pages/sending/syslog.html https://kb.fortinet.com/kb/documentLink.do?externalID=FD45621 https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-23/CommonEventFormatV25.pdf https://datatracker.ietf.org/doc/html/rfc6587 https://datatracker.ietf.org/doc/html/rfc5424
HS-441221484