[
https://issues.apache.org/jira/browse/FLUME-1266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13292396#comment-13292396
]
Hari Shreedharan edited comment on FLUME-1266 at 6/9/12 6:06 PM:
-----------------------------------------------------------------
Hi Rajesh,
The SyslogTcpSource(and SyslogUDPSource) expects incoming data to comply with
(a subset of) RFC-5424(http://tools.ietf.org/html/rfc5424). If you need to send
arbitrary data to Flume, please use the NETCAT source, which allows you to send
any data (provided each event contains <512 bytes).
Since your data is arbitrary and not in the required format, the syslog source
tags the data as invalid, and inserts the header, so that such data can be
filtered using a MultiplexingChannelSelector and diverted elsewhere. What you
see here is expected behavior.
was (Author: hshreedharan):
Hi Rajesh,
The SyslogTcpSource(and SyslogUDPSource) expects incoming data to comply with
(a subset of) RFC-5424(http://tools.ietf.org/html/rfc5424). If you need to send
arbitrary data to Flume, please use the NETCAT source, which allows you to send
any data (provided each event contains <512 bytes).
Since your data is arbitrary and not in the required format, the syslog source
tags the data as invalid, and inserts the header, so that such data can be
filtered using a MultiplexingChannelSelector and diverted elsewhere.
> Event created from invalid syslog data
> --------------------------------------
>
> Key: FLUME-1266
> URL: https://issues.apache.org/jira/browse/FLUME-1266
> Project: Flume
> Issue Type: Bug
> Components: Sinks+Sources
> Environment: trunk, ubuntu11
> Reporter: Rajesh Koilpillai
> Priority: Minor
>
> I get the following error when submitting an event via SyslogTcpSource on the
> latest source code.
> echo "hello world via syslog" | nc -t localhost 10514
> 2012-06-09 12:11:05,025 INFO source.SyslogTcpSource: Syslog TCP Source
> starting...
> 2012-06-09 12:11:51,693 WARN source.SyslogUtils: Event created from Invalid
> Syslog data.
> 2012-06-09 12:11:51,698 INFO sink.LoggerSink: Evecnt: { headers:{Severity=0,
> flume.syslog.status=Invalid, Facility=0} body: 68 65 6C 6C 6F 20 77 6F 72 6C
> 64 20 76 69 61 20 hello world via }
> My config is as follows
> agent1.sources.accesslog.type = org.apache.flume.source.SyslogTcpSource
> agent1.sources.accesslog.host = 0.0.0.0
> agent1.sources.accesslog.port = 10514
> agent1.sources.accesslog.channels = ch1
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
