TCP Syslog?

Hey @mnagel, my understanding is that neither RFC allows for a message lacking the hostname, which is what we were seeing with lots of Cisco syslog. They seem to admit as much: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc35989

We use syslog4j under the hood to parse messages. It could not parse them out of the box, so we modified it to handle Cisco's syslog. RFC compliant or not, we can't reasonably not support syslog for one of the largest network vendors in the world.

The graylog project did essentially the same thing to handle Cisco and Fortinet syslog.


As for the field limitations, I need to do some more reading. I realize you have another solution, but I'd still like to improve what we have.