Hey @kwart

First of all I would like to thank you. This project has helped me understand how syslog4j library works and save me a ton of time.

This is not actually an issue, it's rather a background question. I've been reseaching about "org.syslog4j" because the last published version was 10 years ago. Do you know whether is any other recent version or any other library trustworthy to handle syslog servers in java? I've found a lot of repos which contain the original sylog4j source code patched (fixing minor issues) but even these have been many years unmanteined.

Thanks for your time

I'm studying your project recently. But I have some problems.

When using the TLS protocol, it prompted me some errors. I realized I needed to configure rsyslog. conf. Could you show me this file what you configured?

Thanks

I have two machines on the same home LAN. Machine 1 has IP of 192.168.0.12 and Machine 2 has an IP of 192.168.0.14.

On Machine 2 (the syslog server running this project) I build the project via mvn package and then run it out of the target directory via java -jar simple-syslog-server.jar tls. Then back on Machine 1 (the syslog "client") I run:

nc -w0 192.168.0.14 9898 <<< "<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8"

Back on Machine 2 I get SSL-related errors. Here is the exact console output from Machine 2:

java -jar simple-syslog-server.jar tls
Simple syslog server (RFC-5424)
Usage:
  java -jar simple-syslog-server.jar [protocol]

Possible protocols: udp, tcp, tls

Starting Simple Syslog Server

Protocol:     tls
Bind address: 0.0.0.0
Port:         9898
Creating Syslog server socket


Handling Syslog client /192.168.0.12
javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
  at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451)
  at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175)
  at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:110)
  at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1418)
  at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1324)
  at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
  at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:829)
  at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:920)
  at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252)
  at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:271)
  at com.github.kwart.syslog.TCPSyslogSocketHandler.run(TCPSyslogSocketHandler.java:89)
  at java.base/java.lang.Thread.run(Thread.java:836)

Do I need to change the message format for TLS?

Hi I'm trying to get this tool working on my home network. On Laptop 1 (the "syslog server") I clone this project, run mvn package, and then from inside the target directory, I run:

java -jar simple-syslog-server.jar tcp

The syslog server starts up (!!!) and I see:

Simple syslog server (RFC-5424)
Usage:
  java -jar simple-syslog-server.jar [protocol]

Possible protocols: udp, tcp, tls

Starting Simple Syslog Server
Protocol:     tcp
Bind address: 0.0.0.0
Port:         9898
Creating Syslog server socket

From Laptop 2 I run:

nc -w0 <laptop1.ip> 9898 <<< "testing again from my home machine"

Where, obviously, <laptop1.ip> is Laptop 1's local IP address on the home network. As soon as I run that command, from Laptop 1, I see:

Handling Syslog client /<laptop2.ip>
Exception in thread "Thread-4" java.lang.StringIndexOutOfBoundsException
  at java.base/java.lang.String.<init>(String.java:615)
  at com.github.kwart.syslog.Rfc5424SyslogEvent.getString(Rfc5424SyslogEvent.java:116)
  at com.github.kwart.syslog.Rfc5424SyslogEvent.<init>(Rfc5424SyslogEvent.java:65)
  at com.github.kwart.syslog.TCPSyslogSocketHandler.handleSyslogMessage(TCPSyslogSocketHandler.java:100)
  at com.github.kwart.syslog.TCPSyslogSocketHandler.run(TCPSyslogSocketHandler.java:75)
  at java.base/java.lang.Thread.run(Thread.java:836)

Am I doing anything wrong here? Is that not a valid syslog message? If its is, how can I troubleshoot this some more? Thanks in advance!

Hello,

When I try to deploy JAR file to Pivotal Cloud Foundry, I had some problems with conf (set TCP as default and change the port number to 8080) but I solved that. So, now I get 502 in log and I cannot resolve why this happened?

There are modified logs:

2020-05-19T14:54:39.184+08:00 [CELL/0] [OUT] Container became healthy 2020-05-19T14:54:39.515+08:00 [APP/PROC/WEB/0] [OUT] Handling Syslog client /10.1.1.10 2020-05-19T14:54:48.574+08:00 [RTR/3] [OUT] java-syslog-service.myurl.com - [2020-05-19T12:54:45.571+0000] "OPTIONS /cloudfoundryapplication HTTP/1.1" 502 0 67 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" "55.66.77.88:2206" "10.1.1.10:61001" x_forwarded_for:"11.22.33.44, 55.66.77.88" x_forwarded_proto:"https" vcap_request_id:"123" response_time:2.002447003 app_id:"123" app_index:"0" x_b3_traceid:"123" x_b3_spanid:"123" x_b3_parentspanid:"-" b3:"123-123"