Page MenuHomeVyOS Platform

Syslog doesn't send timezone information to the server
Closed, ResolvedPublicFEATURE REQUEST

Description

https://forum.vyos.io/t/syslog-remote-time-zone-rsyslog-syslogprotocol23format/11555

The bug is about not sending timezone in logs to remote log collector.

vyos doc: https://docs.vyos.io/en/equuleus/configuration/system/syslog.html#remote-host

What is rfc5424: https://datatracker.ietf.org/doc/html/rfc5424

current implementation: https://github.com/vyos/vyos-1x/pull/573

What is the problem?
logs are send without time zone which means server which collect them can't determine time zone, so assume UTC.
In consequence if you live on the right side of the globe of UTC-0 you have data from the future. "Last hour" logs doesn't show fresh logs, because new one are in the future. Data from the future in general is a problem.
If you live on the left side of the globe, then your logs are for example -3hours.

How to fix:
Assumption server collecting logs has set the same time zone as all vyos servers is wrong. Time zone should be always sent. Make rfc5424 standard as default one and always use it for remote server. Sending logs to remote server without time zone is not good practice.

If you don't want to make it as default behaviour add set system syslog host X.X.X.X format rfc5424.

Please notice rfc5424 work for both TCP / UDP and doesn't need to have custom port to set. Right now in code there are if conditions for protocol TCP and custom port.

Details

Version
all, but tested on 1.3
Is it a breaking change?
Behavior change
Issue type
Bug (incorrect behavior)

Event Timeline

kwladyka changed Version from - to all, but tested on 1.3.
Viacheslav changed the task status from Open to Needs reporter action.Jan 20 2024, 12:52 PM
Viacheslav triaged this task as Normal priority.
Viacheslav subscribed.

@kwladyka Could you create a PR?

@Viacheslav I am not Python developer. Settings this up with tests will take much time for me.

I general on the end it is about string like this:

*.notice @host:port;RSYSLOG_SyslogProtocol23Format

dmbaturin renamed this task from Syslog remote time zone RSYSLOG_SyslogProtocol23Format to Syslog doesn't send timezone information to the server.Jul 3 2024, 12:58 PM
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Behavior change.
zsdc changed the task status from Needs reporter action to Confirmed.Jul 29 2024, 7:09 AM
zsdc subscribed.

I agree, the logic in a template seems to be wrong.

  1. Message format should not depend on a transport protocol. This is an independent thing. However, pay attention: RSYSLOG_SyslogProtocol23Format is very close to the RFC5424, but it does not match it completely.
  2. The octet-counted modifier (o) should not be used for UDP at all.

We need to modify the template, taking this into account.

Setting a new format as a default one can be a breaking change for some receivers, therefore I recommend adding the format option, especially because there can be many different formats, not only RFC5424.

c-po moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.1) board.