syslog ng tcp tls

[milank78git]

Version of syslog-ng server 3.18

k8s

have set up a syslog-ng server on TCP TLS, and additional parameters started appearing in my messages. 192.168.219.196 335 <30>1 2024-03-18T15:13:41.000000+01:00 Nas-1 audit_protocol 6691 - - S-1-5-21- ........

What is 192.168.219.196 335 <30>1

Unfortunately, I'm having trouble deciphering what they are.

Pls help

Thanks.

[bazsi]

the syslog-ng config you are using would be helpful. The message you are receiving is in the RFC5424 format, with octet counted messages, that's the 335 in front of the message itself.

You are probably using the incorrect source driver, e.g. you should be using syslog(transport(tls)) which will parse this format correctly.

Another question is what kind of destination are you using for the output? The config would help here similarly.