Thank Rainer - I’ve experienced a sort of similar issue where messages starting with numeric characters cause the parse_json function to return a value of zero (message is a JSON object) when it is clearly NOT a JSON object. I posted about it a while ago but never saw a response.
I’ll check out the framing module parameter that disables the octet counting functionality as we’ve never had a need for such a thing in our environment. > On Oct 14, 2021, at 12:16, Rainer Gerhards <[email protected]> wrote: > > I need to check the code, but as "framing error" is quoted, and "pri > is missing" is said, I think the case is that 2021 is right at the > start of the message. That triggers octet-counted framing (message > terminated after n bytes/octets, not on LF). In that mode, a SP needs > to follow after the octet count, but a "-" follows. > > IAW: the syslog framing is broken and indeed it is :-) You can disable > octet counted framing via a module parameter, but it is always a bit > dangerous to feed non-syslog data to the syslog receiver. > > Rainer > > El jue, 14 oct 2021 a las 15:35, John Chivian via rsyslog > (<[email protected]>) escribió: >> >> Group: >> >> Can someone help me understand why sending this exact plain text to an >> rsyslog network listener… >> >> 2021-10-14T08:26:31.444-00:00 >> >> …results in this exact error message in the rsyslog log file? >> >> 2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error >> in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: >> delimiter is not SP but has ASCII value 45. [v8.2102.0] >> >> >> Yes, I know the priority and version are missing, but that doesn’t seem to >> explain why the error is occurring. Any help is greatly appreciated. >> >> The input configuration is as follows… >> >> input(type=“imptcp” name=“ptcp-51419-in” port=“51419” >> ruleset=“from_appname”) >> >> >> Thanks in advance, >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
