[
https://issues.apache.org/jira/browse/LOG4J2-2532?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16759312#comment-16759312
]
Ralph Goers commented on LOG4J2-2532:
-------------------------------------
I just took a look at [https://tools.ietf.org/html/rfc5425.] It says the 2 byte
length prefix is required for TLS syslog messages.
> SyslogAppender with RFC5424 and TLS is prepending messagelength
> ---------------------------------------------------------------
>
> Key: LOG4J2-2532
> URL: https://issues.apache.org/jira/browse/LOG4J2-2532
> Project: Log4j 2
> Issue Type: Bug
> Components: Core, Layouts
> Affects Versions: 2.11.1
> Environment: Linux
> Reporter: Maximilian
> Priority: Blocker
> Original Estimate: 1h
> Time Spent: 0.5h
> Remaining Estimate: 0.5h
>
> If I want to log via Syslog (RFC5424) the logs seem to have the length of the
> message in front of the message which results in parser errors at the
> syslogserver.
> {{config:}}
> {{<?xml version="1.0" encoding="UTF-8"?>}}
> {{ <Configuration status="INFO">}}
> {{ <Appenders>}}
> {{ <Syslog name="local" host="localhost" port="10001" format="RFC5424"
> newLine="true" id="App" mdcId="9999">}}
> {{ <SSL>}}
> {{ <TrustStore location="trust.jks" password="testtest" />}}
> {{ </SSL>}}
> {{ </Syslog>}}
> {{ </Appenders>}}
> {{ <Loggers>}}
> {{ <Root level="debug">}}
> {{ <AppenderRef ref="local"/>}}
> {{ </Root>}}
> {{ </Loggers>}}
> {{ </Configuration> }}
> {{Result (with openssl s_server -key private.pem -cert public.pem -accept
> 10001):}}
> {{67 <134>1 2019-01-14T13:26:14.947+01:00 apu localhorst 12866 - - Test}}
> Expected result:
> {{<134>1 2019-01-14T13:26:14.947+01:00 apu localhorst 12866 - - Test}}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
