The syslog parser analyzes badly the logs about graylog2-server HOT 8 CLOSED

+1 run in this error too ... fixed it by using logstash in the middle and send gelf messages via amqp to graylog (i need this for other logfiles, so nothing new for me) ...

from graylog2-server.

Looking into this, thanks.

from graylog2-server.

It seams to be a problem with the parseHost() function in SyslogProcessor.java. This function returns msg.getHost(), and so, the problem is not specific to graylog2-server but to syslog4j (org.productivity.java.syslog4j.server.SyslogServerEventIF).

But if we replace "return msg.getHost()" by "return remoteAddress.getHostAddress()", the problem is solved :)

from graylog2-server.

we will address this in the syslog parser rewrite. i'll add your example as a test case.

from graylog2-server.

FYI: The same issue exists in 0.11.0 build. I encounter process name with PID instead of host name.

from graylog2-server.

Hi,

The problem is present in last version :( in 0.12

 Find a solution : in rsyslog :+1:

$template GRAYLOG2,"<%PRI%>1 %timegenerated:::date-rfc3339% %HOSTNAME% %syslogtag% - %APP-NAME%: %msg:::drop-last-lf%\n"
$ActionForwardDefaultTemplate GRAYLOG2

from graylog2-server.

This can be solved in v0.20.0 using the newly introduced extractors!

from graylog2-server.

I just encoutered this issue in graylog 2.0.0-beta.1.
Shouldn't source by default have ip instead of trying to extract from syslog msg?

from graylog2-server.