Restituisci
-
Titolo
Logs show in TCPDump but not in Syslog-ng -
Descrizione
Logs can be seen incoming through a tcpdump, however, Syslog-ng is not showing the reception of any logs. -
Causa
The logs being sent from the endpoint are missing a newline character at the end to delineate between multiple logs, therefore, Syslog-ng cannot tell where one log ends and the next starts so no logs are processed. -
Risoluzione
The endpoint sending logs to Syslog-ng need to ensure that a newline character is included at the end of the log so that each individual log is processed.
For example, should the endpoint be CyberArk, please use an .xsl that contains the newline character to ensure logs sent to Syslog-ng are processed correctly.
To confirm whether or not a newline character is present, perform a TCPDump using the Hex dump option and look for the newline character in Hex which is "0a" (The number zero followed by the lower-case character a).
If the "0a" Hex code is missing at the end of the log then the newline character is not present.