Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-11746

Syslog data is not fully RFC compliant

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 14.1.1, 14.5.0
    • Fix Version/s: 6.0.0, 5.5.2
    • Component/s: audit logging
    • Labels:
    • Sprint:
      AM Sustaining Sprint 42, AM Sustaining Sprint 43, AM Sustaining Sprint 44, AM Sustaining Sprint 45, AM Sustaining Sprint 46, AM Sustaining Sprint 47
    • Story Points:
      1
    • Needs backport:
      No
    • Support Ticket IDs:
    • Needs QA verification:
      No
    • Functional tests:
      No
    • Are the reproduction steps defined?:
      No (add reasons in the comment)

      Description

      Bug description

      Standards the syslog data should follow:

      Message format: rfc5424 
      Transport encapsulation: rfc6587 Octet Counting

       
      Non-compliance with these:

      1). Trailing space at the end of log messages:

      Messages sent by AM / DJ only contain the STRUCTURED-MSG part and leave out the optional [SP MSG] part. According to the RFC, they should end with the last "]" of that part. But they end with a space.

      2). Disallowed characters in APP-NAME and SD-ID:

      The fields APP-NAME and SD-ID both contain spaces, which is not allowed by RFC5424 and makes the format ambiguous due to space being the field delimiter.

      How to reproduce the issue

       

       

      Expected behaviour
      Logging data arrives syslog in expected compliant structure format enabling it to be parsed.
      Current behaviour
      All log events have arrive in one line. 
      There is no line break after a syslog message.
      

      Work around

      Code analysis

       

      The relevant code can is part of the commons audit:

      forgerock-audit-handler-syslog/src/main/java/org/forgerock/audit/handlers/syslog/

       

       

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                jonthomas Jonathan Thomas
                Reporter:
                jonthomas Jonathan Thomas
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: