Retour
-
Titre
Syslog-ng Storebox rejects RFC 5424 logs after restarting syslog-ng -
Description
When switching from Legacy to IETF source type and committing that change ongoing connections are not terminated. However, if syslog-ng is restarted then messages may be dropped and the following error reported in the local logs.
“Invalid frame header; header=''
-
Cause
The SSB received logs of IETF (RFC 5424) format but without (RFC 6587) frames. -
Résolution
If the incoming messages need to be parsed
- Configure the log sender side to put (RFC 6587) frames into the (RFC 5424) log messages to indicate the lengths of the logs. This must be configured on the source device/appliance.
- If it is not possible to configure the source device to put (RFC 6587) frames into the (RFC 5424) log messages, install a syslog-ng externally (Syslog-ng relay) which receives the logs before the SSB and it is possible to configure receiving the logs WITHOUT frames, parse the logs and forward them to the SSB in IETF format (with frames).
If the incoming messages do not need to be parsed.
- Use BSD syslog source with "do not parse" sub-option.