Forum Discussion

gondeeri's avatar
gondeeri
Icon for Nimbostratus rankNimbostratus
Sep 17, 2018

HSL logging to Graylog via TCP

Hello,

For HSL loggin we are using graylog server... we have following set up in irule

when CLIENT_ACCEPTED {

set hsl [HSL::open -proto UDP -pool xxxx_hsl_pool]
}

set logstr "{\"Request_time\": \"$startTime\",\"Request_timeF\": \"$startTimeF\",\"RequestId\"}\n"

HSL::send $hsl $logstr

If we are using UDP it is OK...messages are sending to graylog and are visible there...

But we want use TCP because some messages was not delivered to graylog via UDP... but we have problem if we set up TCP messges which are sending to graylog are to much split or more messages are sending in one message .. Do you have anyone experience HSL logging via TCP.

PS: in our solution we are not able us HSL profile for remote logging..

thx

application delivery
LTM

1 Reply

Sort By
  • youssef_100679's avatar
    youssef_100679
    Icon for Nimbostratus rankNimbostratus
    Sep 17, 2018

    Hi,

     

    did you see this answers:

     

    https://devcentral.f5.com/questions/hsl-logging-sending-multiple-log-entries-in-one-message

     

    from jeesie (F5):

     

    Classical syslog (RFC3164) expects one message per UDP packet with no terminating newline. Many servers also support TCP transport and expect the messages to be separated by newlines, but there is no formal standard for this -- even the later RFC5424 does not define how messages should be separated when encapsulated in protocols other than UDP. Your iRule is not providing a separator, so message separation is essentially being left up to server intelligence and luck. If you add a "\n" to the end of your string, your problems should go away :). It would be possible to make HSL::send "smart" enough to automagically append a newline when logging to a TCP destination and add a -nonewline flag for users who really do want a "raw" send so they can use arbitrary separators. OTOH, any time you make something "smart", you also make it more confusing.

     

    So you have to add "\r\n" to the end of the log entry (a CRLF) and configured your syslog server to split on CR/LF. And it will fix your problem.

     

    Keep me update.

     

    regards