[FLUME-1277] Error parsing Syslog rfc 3164 messages with null values

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.1.0, 1.2.0
• Fix Version/s: 1.3.0
• Component/s: Sinks+Sources
• Assignee: Brock Noland
• Reporter: Brent Halsey
• Created: 13/Jun/12 02:07
• Updated: 12/Nov/12 04:29
• Resolved: 10/Nov/12 20:40

Description

The SyslogUtils class doesn't properly parse rfc 3164 style messages containing a null (hyphen) value. e.g.,
<10>Apr 1 13:14:04 ubuntu-11.cloudera.com - rest_of_message

It tries to parse it as a 5424 style message, skips over the date information, and interprets the first hyphen as a null timestamp. Part of the problem is the use of a Scanner and regex. This skips over a properly formatted 3164 style message until it finds anything that matches the 5424 regex, including a hyphen.

Issue Links

• is duplicated by: FLUME-1365 Flume-ng with syslog events break with certain characters in message body
• links to: Review Board