crewjam / rfc5424 Goto Github PK

Hi @crewjam,

thanks for making that code available.

I'm currently experimenting with using your library to parse syslog messages that are received via a HTTPS endpoint, i.e. the client is sending messages via a HTTP POST.

In my ServeHTTP function, I'm doing basically this:

        scanner := bufio.NewScanner(req.Body)
        for scanner.Scan() {
            b := scanner.Bytes()
            if len(b) > 0 {
                var m *rfc5424.Message = &rfc5424.Message{}
                if err = m.UnmarshalBinary(b); err != nil {
                    fmt.Printf("cannot parse msg: %v\n", err)
                } else {
                    h.msgQueue <- *m
                }
            }
        }
        req.Body.Close()

But using this, the Message field gets screwed up if more than one syslog line is sent in the request body.

Looking at func (m *Message) UnmarshalBinary(inputBuffer []byte) I fear that the assignment

      m.Message = r.Bytes()

is unsafe and should be replaced by

    m.Message = make([]byte, len(r.Bytes()))
    copy(m.Message, r.Bytes())

Best

Michael

The only way to parse syslog messages is by creating an empty message struct and calling its method. I don't think this is idiomatic go. Why not just have a generic parse() function which returns a message or a slice of messages from whatever was parsed?

Would a PR be welcome? Is the library still maintained? There's only one release (0.1.0)

We're creating a message like this:

msg := rfc5424.Message{
		Priority:  rfc5424.Daemon | rfc5424.Info,
		Timestamp: time.Now(),
		Hostname:  al.osHostname,
		ProcessID: al.osPid,
		AppName:   "fusion",
		Message:   p,
	}

Here, we've set AppName to "fusion". However, the remote rsyslog server receives the app-name property as "<30>1". Does this library set the app-name property?

https://www.rsyslog.com/doc/master/configuration/properties.html

FYI, the reason I ask is because I would like to filter on app-name, such as:

if $app-name == "fusion" then :omstdout:

When creating a syslog message, this library uses nine digits for the nanoseconds. The RFC stipulates six digits for TIME-SECFRAC here.

See example 5 where nine digits is explicitly called out as invalid.

Are you interested in a PR for this change?

Here is how we fixed the issue in our fork.