Merge pull request #245 from bazsi/retain-rawmsg-on-msg-parse-errors

Add no-piggyback-errors flag to syslog-parser() and syslog related source drivers.

lib/logmsg/logmsg.c

@@ -1263,6 +1263,19 @@ log_msg_format_sdata(const LogMessage *self, GString *result,  guint32 seq_num)
   log_msg_append_format_sdata(self, result, seq_num);
 }
 
+void
+log_msg_clear_sdata(LogMessage *self)
+{
+  for (gint i = 0; i < self->num_sdata; i++)
+    log_msg_unset_value(self, self->sdata[i]);
+  if (!log_msg_chk_flag(self, LF_STATE_OWN_SDATA))
+    {
+      self->sdata = NULL;
+      self->alloc_sdata = 0;
+    }
+  self->num_sdata = 0;
+}
+
 gboolean
 log_msg_append_tags_callback(const LogMessage *self, LogTagId tag_id, const gchar *name, gpointer user_data)
 {
@@ -1366,6 +1379,8 @@ log_msg_init(LogMessage *self)
 void
 log_msg_clear(LogMessage *self)
 {
+  g_assert(!log_msg_is_write_protected(self));
+
   if(log_msg_chk_flag(self, LF_STATE_OWN_PAYLOAD))
     nv_table_unref(self->payload);
   self->payload = nv_table_new(LM_V_MAX, 16, 256);
@@ -1386,12 +1401,7 @@ log_msg_clear(LogMessage *self)
     }
 
   log_msg_clear_matches(self);
-  if (!log_msg_chk_flag(self, LF_STATE_OWN_SDATA))
-    {
-      self->sdata = NULL;
-      self->alloc_sdata = 0;
-    }
-  self->num_sdata = 0;
+  log_msg_clear_sdata(self);
 
   if (log_msg_chk_flag(self, LF_STATE_OWN_SADDR))
     g_sockaddr_unref(self->saddr);
@@ -2009,6 +2019,14 @@ log_msg_tags_init(void)
   log_tags_register_predefined_tag("syslog.unexpected_framing", LM_T_SYSLOG_UNEXPECTED_FRAMING);
   log_tags_register_predefined_tag("syslog.rfc3164_missing_header", LM_T_SYSLOG_RFC3164_MISSING_HEADER);
   log_tags_register_predefined_tag("syslog.rfc5424_unquoted_sdata_value", LM_T_SYSLOG_RFC5424_UNQUOTED_SDATA_VALUE);
+
+  log_tags_register_predefined_tag("syslog.rfc5424_missing_hostname", LM_T_SYSLOG_RFC5424_MISSING_HOSTNAME);
+  log_tags_register_predefined_tag("syslog.rfc5424_missing_app_name", LM_T_SYSLOG_RFC5424_MISSING_APP_NAME);
+  log_tags_register_predefined_tag("syslog.rfc5424_missing_procid", LM_T_SYSLOG_RFC5424_MISSING_PROCID);
+  log_tags_register_predefined_tag("syslog.rfc5424_missing_msgid", LM_T_SYSLOG_RFC5424_MISSING_MSGID);
+  log_tags_register_predefined_tag("syslog.rfc5424_missing_sdata", LM_T_SYSLOG_RFC5424_MISSING_SDATA);
+  log_tags_register_predefined_tag("syslog.rfc5424_invalid_sdata", LM_T_SYSLOG_RFC5424_INVALID_SDATA);
+  log_tags_register_predefined_tag("syslog.rfc5424_missing_message", LM_T_SYSLOG_RFC5424_MISSING_MESSAGE);
 }
 
 void

lib/logmsg/logmsg.h

@@ -120,6 +120,22 @@ enum
   LM_T_SYSLOG_RFC3164_MISSING_HEADER,
   /* incorrectly quoted RFC5424 SDATA */
   LM_T_SYSLOG_RFC5424_UNQUOTED_SDATA_VALUE,
+  /* hostname field missing */
+  LM_T_SYSLOG_RFC5424_MISSING_HOSTNAME,
+  /* program field missing */
+  LM_T_SYSLOG_RFC5424_MISSING_APP_NAME,
+  /* pid field missing */
+  LM_T_SYSLOG_RFC5424_MISSING_PROCID,
+  /* msgid field missing */
+  LM_T_SYSLOG_RFC5424_MISSING_MSGID,
+  /* sdata field missing */
+  LM_T_SYSLOG_RFC5424_MISSING_SDATA,
+  /* invalid SDATA */
+  LM_T_SYSLOG_RFC5424_INVALID_SDATA,
+  /* sdata field missing */
+  LM_T_SYSLOG_RFC5424_MISSING_MESSAGE,
+  /* message field missing */
+  LM_T_SYSLOG_MISSING_MESSAGE,
   LM_T_PREDEFINED_MAX,
 };
 
@@ -483,6 +499,7 @@ void log_msg_rename_value(LogMessage *self, NVHandle from, NVHandle to);
 
 void log_msg_append_format_sdata(const LogMessage *self, GString *result, guint32 seq_num);
 void log_msg_format_sdata(const LogMessage *self, GString *result, guint32 seq_num);
+void log_msg_clear_sdata(LogMessage *self);
 
 void log_msg_set_tag_by_id_onoff(LogMessage *self, LogTagId id, gboolean on);
 void log_msg_set_tag_by_id(LogMessage *self, LogTagId id);

lib/logmsg/tests/test_log_message.c

@@ -77,6 +77,9 @@ assert_log_msg_clear_clears_all_properties(LogMessage *message, NVHandle nv_hand
                                            NVHandle sd_handle, const gchar *tag_name)
 {
   message->flags |= LF_LOCAL + LF_UTF8 + LF_INTERNAL + LF_MARK;
+  LogPathOptions path_options = LOG_PATH_OPTIONS_INIT;
+
+  log_msg_make_writable(&message, &path_options);
   log_msg_clear(message);
 
   cr_assert_str_empty(log_msg_get_value(message, nv_handle, NULL),
@@ -186,6 +189,19 @@ Test(log_message, test_log_message_can_be_cleared)
   log_message_test_params_free(params);
 }
 
+Test(log_message, test_log_message_clear_sdata_unsets_all_sdata)
+{
+  LogMessageTestParams *params = log_message_test_params_new();
+
+  log_msg_clear_sdata(params->message);
+
+  cr_assert(params->message->num_sdata == 0);
+  cr_assert_str_empty(log_msg_get_value(params->message, params->sd_handle, NULL),
+                      "Message still contains sdata value after log_msg_clear_sdata");
+
+  log_message_test_params_free(params);
+}
+
 Test(log_message, test_log_msg_clear_handles_cloned_noninline_tags_properly)
 {
   LogMessage *msg = _construct_log_message();

lib/msg-format.c

@@ -29,6 +29,7 @@
 #include "find-crlf.h"
 #include "scratch-buffers.h"
 #include "utf8utils.h"
+#include "hostname.h"
 
 static gsize
 _rstripped_message_length(const guchar *data, gsize length)
@@ -39,14 +40,22 @@ _rstripped_message_length(const guchar *data, gsize length)
 }
 
 static void
-msg_format_inject_parse_error(LogMessage *msg, const guchar *data, gsize length, gint problem_position)
+msg_format_inject_parse_error(MsgFormatOptions *options, LogMessage *msg, const guchar *data, gsize length,
+                              gint problem_position)
 {
   GString *buf = scratch_buffers_alloc();
 
+
+  /* overwrite the message as if it was coming from syslog-ng */
   log_msg_clear(msg);
 
   msg->timestamps[LM_TS_STAMP] = msg->timestamps[LM_TS_RECVD];
-  log_msg_set_value(msg, LM_V_HOST, "", 0);
+
+  const gchar *hname = options->use_fqdn
+                       ? get_local_hostname_fqdn()
+                       : get_local_hostname_short();
+
+  log_msg_set_value(msg, LM_V_HOST, hname, -1);
 
   if (problem_position > 0)
     g_string_printf(buf, "Error processing log message: %.*s>@<%.*s", (gint) problem_position-1,
@@ -173,7 +182,8 @@ msg_format_parse_into(MsgFormatOptions *options, LogMessage *msg,
   if (!msg_format_try_parse_into(options, msg, data, length, &problem_position))
     {
       log_msg_set_tag_by_id(msg, LM_T_MSG_PARSE_ERROR);
-      msg_format_inject_parse_error(msg, data, _rstripped_message_length(data, length), problem_position);
+      if (options->flags & LP_PIGGYBACK_ERRORS)
+        msg_format_inject_parse_error(options, msg, data, _rstripped_message_length(data, length), problem_position);
 
       /* the injected error message needs to be postprocessed too */
       msg_format_postprocess_message(options, msg, data, length);
@@ -228,7 +238,7 @@ msg_format_options_set_sdata_prefix(MsgFormatOptions *options, const gchar *pref
 void
 msg_format_options_defaults(MsgFormatOptions *options)
 {
-  options->flags = LP_EXPECT_HOSTNAME | LP_STORE_LEGACY_MSGHDR;
+  options->flags = LP_EXPECT_HOSTNAME | LP_STORE_LEGACY_MSGHDR | LP_PIGGYBACK_ERRORS;
   options->recv_time_zone = NULL;
   options->recv_time_zone_info = NULL;
   options->bad_hostname = NULL;
@@ -264,6 +274,7 @@ msg_format_options_init(MsgFormatOptions *options, GlobalConfig *cfg)
   if (!options->sdata_prefix)
     options->sdata_prefix = g_strdup(logmsg_sd_prefix);
   options->sdata_prefix_len = strlen(options->sdata_prefix);
+  options->use_fqdn = cfg->host_resolve_options.use_fqdn;
   options->initialized = TRUE;
 }
 
@@ -319,6 +330,8 @@ CfgFlagHandler msg_format_flag_handlers[] =
   { "guess-timezone",             CFH_SET, offsetof(MsgFormatOptions, flags), LP_GUESS_TIMEZONE },
   { "no-header",                  CFH_SET, offsetof(MsgFormatOptions, flags), LP_NO_HEADER },
   { "no-rfc3164-fallback",        CFH_SET, offsetof(MsgFormatOptions, flags), LP_NO_RFC3164_FALLBACK },
+  { "piggyback-errors",           CFH_SET, offsetof(MsgFormatOptions, flags), LP_PIGGYBACK_ERRORS },
+  { "no-piggyback-errors",      CFH_CLEAR, offsetof(MsgFormatOptions, flags), LP_PIGGYBACK_ERRORS },
   { NULL },
 };
 

lib/msg-format.h

@@ -59,6 +59,7 @@ enum
   LP_GUESS_TIMEZONE = 0x1000,
   LP_NO_HEADER = 0x2000,
   LP_NO_RFC3164_FALLBACK = 0x4000,
+  LP_PIGGYBACK_ERRORS = 0x8000,
 };
 
 typedef struct _MsgFormatHandler MsgFormatHandler;
@@ -76,6 +77,7 @@ typedef struct _MsgFormatOptions
   gchar *sdata_prefix;
   gsize sdata_prefix_len;
   gint sdata_param_value_max;
+  gboolean use_fqdn;
 } MsgFormatOptions;
 
 struct _MsgFormatHandler

lib/tests/test_msgparse.c

@@ -31,6 +31,7 @@
 #include "gsockaddr.h"
 #include "timeutils/cache.h"
 #include "timeutils/misc.h"
+#include "scratch-buffers.h"
 #include "cfg.h"
 #include "plugin.h"
 
@@ -138,6 +139,7 @@ setup(void)
 void
 teardown(void)
 {
+  scratch_buffers_explicit_gc();
   deinit_syslogformat_module();
   app_shutdown();
 }
@@ -175,7 +177,8 @@ test_log_messages_can_be_parsed(struct msgparse_params *param)
 
   cr_assert_eq(parsed_message->pri, param->expected_pri, "Unexpected message priority %d != %d",
                parsed_message->pri, param->expected_pri);
-  assert_log_message_value(parsed_message, LM_V_HOST, param->expected_host);
+  if (param->expected_host)
+    assert_log_message_value(parsed_message, LM_V_HOST, param->expected_host);
   assert_log_message_value(parsed_message, LM_V_PROGRAM, param->expected_program);
   assert_log_message_value(parsed_message, LM_V_MESSAGE, param->expected_msg);
   if (param->expected_pid)
@@ -241,10 +244,10 @@ Test(msgparse, test_bad_sd_data_unescaped)
   {
     {
       "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\"\"ok\"] An application event log entry...",
-      LP_SYSLOG_PROTOCOL, NULL,
+      LP_SYSLOG_PROTOCOL | LP_PIGGYBACK_ERRORS, NULL,
       43,             // pri
       0, 0, 0,    // timestamp (sec/usec/zone)
-      "",        // host
+      NULL,        // host
       "syslog-ng", //app
       "Error processing log message: <132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\">@<\"ok\"] An application event log entry...", // msg
       "", //sd_str
@@ -691,10 +694,11 @@ Test(msgparse, test_expected_sd_pairs_1)
       expected_sd_pairs_test_1
     },
     {
-      "<7>1 2006-10-29T01:59:59.156Z mymachine.example.com evntslog - ID47 [ exampleSDID@0 iut=\"3\" eventSource=\"Application\" eventID=\"1011\"][examplePriority@0 class=\"high\"] \xEF\xBB\xBF" "An application event log entry...",  LP_SYSLOG_PROTOCOL, NULL,
+      "<7>1 2006-10-29T01:59:59.156Z mymachine.example.com evntslog - ID47 [ exampleSDID@0 iut=\"3\" eventSource=\"Application\" eventID=\"1011\"][examplePriority@0 class=\"high\"] \xEF\xBB\xBF" "An application event log entry...",
+      LP_PIGGYBACK_ERRORS | LP_SYSLOG_PROTOCOL, NULL,
       43,             // pri
       0, 0, 0,    // timestamp (sec/usec/zone)
-      "",        // host
+      NULL,        // host
       "syslog-ng", //app
       "Error processing log message: <7>1 2006-10-29T01:59:59.156Z mymachine.example.com evntslog - ID47 >@<[ exampleSDID@0 iut=\"3\" eventSource=\"Application\" eventID=\"1011\"][examplePriority@0 class=\"high\"] \xEF\xBB\xBF" "An application event log entry...", // msg
       "",
@@ -879,10 +883,11 @@ Test(msgparse, test_expected_sd_pairs_long)
 
     // parse longer than 255 sd id
     {
-      "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa i=\"long\"] An application event log entry...",  LP_SYSLOG_PROTOCOL, NULL,
+      "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa i=\"long\"] An application event log entry...",
+      LP_PIGGYBACK_ERRORS | LP_SYSLOG_PROTOCOL, NULL,
       43,                         // pri
       0, 0, 0,    // timestamp (sec/usec/zone)
-      "",         // host
+      NULL,         // host
       "syslog-ng", //app
       "Error processing log message: <132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa>@<aaaaaaaa i=\"long\"] An application event log entry...", // msg
       "", //sd_str      0,//processid
@@ -923,10 +928,11 @@ Test(msgparse, test_unescaped_too_long_message_parts)
   {
     // too long hostname
     {
-      "<132>1 2006-10-29T01:59:59.156+01:00 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa evntslog - - [a i=\"ok\"] An application event log entry...",  LP_SYSLOG_PROTOCOL, NULL,
+      "<132>1 2006-10-29T01:59:59.156+01:00 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa evntslog - - [a i=\"ok\"] An application event log entry...",
+      LP_PIGGYBACK_ERRORS | LP_SYSLOG_PROTOCOL, NULL,
       43,        // pri
       0, 0, 0,    // timestamp (sec/usec/zone)
-      "", //host
+      NULL, //host
       "syslog-ng", //app
       "Error processing log message: <132>1 2006-10-29T01:59:59.156+01:00 >@<aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa evntslog - - [a i=\"ok\"] An application event log entry...",        // msg
       "", //sd_str
@@ -979,10 +985,11 @@ Test(msgparse, test_unescaped_too_long_message_parts)
 
     // unescaped ]
     {
-      "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\"]ok\"] An application event log entry...",  LP_SYSLOG_PROTOCOL, NULL,
+      "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\"]ok\"] An application event log entry...",
+      LP_PIGGYBACK_ERRORS | LP_SYSLOG_PROTOCOL, NULL,
       43,             // pri
       0, 0, 0,    // timestamp (sec/usec/zone)
-      "",        // host
+      NULL,        // host
       "syslog-ng", //app
       "Error processing log message: <132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\">@<]ok\"] An application event log entry...", // msg
       "", //sd_str
@@ -994,10 +1001,11 @@ Test(msgparse, test_unescaped_too_long_message_parts)
 
     // bad sd data unescaped "
     {
-      "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\"\"ok\"] An application event log entry...",  LP_SYSLOG_PROTOCOL, NULL,
+      "<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\"\"ok\"] An application event log entry...",
+      LP_PIGGYBACK_ERRORS | LP_SYSLOG_PROTOCOL, NULL,
       43,      // pri
       0, 0, 0, // timestamp (sec/usec/zone)
-      "",    // host
+      NULL,    // host
       "syslog-ng", //app
       "Error processing log message: <132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\">@<\"ok\"] An application event log entry...", // msg
       "", //sd_str
@@ -1218,10 +1226,10 @@ Test(msgparse, test_no_rfc3164_fallback_flag)
   {
     {
       .msg = "<189>some message",
-      .parse_flags = LP_SYSLOG_PROTOCOL | LP_NO_RFC3164_FALLBACK,
+      .parse_flags = LP_SYSLOG_PROTOCOL | LP_NO_RFC3164_FALLBACK | LP_PIGGYBACK_ERRORS,
       .expected_pri = 43,
       .expected_program = "syslog-ng",
-      .expected_host = "",
+      .expected_host = NULL,
       .expected_msg = "Error processing log message: <189>some message",
     },
     {NULL}

modules/syslogformat/syslog-format.c

@@ -1085,13 +1085,17 @@ _syslog_format_parse_syslog_proto(const MsgFormatOptions *parse_options, const g
     goto error;
 
   if (!_skip_space(&src, &left))
-    goto error;
+    {
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_RFC5424_MISSING_HOSTNAME);
+      goto error;
+    }
 
   /* hostname 255 ascii */
   _syslog_format_parse_hostname(msg, &src, &left, &hostname_start, &hostname_len, parse_options->flags, NULL);
   if (!_skip_space(&src, &left))
     {
       src++;
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_RFC5424_MISSING_APP_NAME);
       goto error;
     }
   /* If we did manage to find a hostname, store it. */
@@ -1105,24 +1109,39 @@ _syslog_format_parse_syslog_proto(const MsgFormatOptions *parse_options, const g
   /* application name 48 ascii*/
   _syslog_format_parse_column(msg, LM_V_PROGRAM, &src, &left, 48);
   if (!_skip_space(&src, &left))
-    goto error;
+    {
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_RFC5424_MISSING_PROCID);
+      goto error;
+    }
 
   /* process id 128 ascii */
   _syslog_format_parse_column(msg, LM_V_PID, &src, &left, 128);
   if (!_skip_space(&src, &left))
-    goto error;
+    {
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_RFC5424_MISSING_MSGID);
+      goto error;
+    }
 
   /* message id 32 ascii */
   _syslog_format_parse_column(msg, LM_V_MSGID, &src, &left, 32);
   if (!_skip_space(&src, &left))
-    goto error;
+    {
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_RFC5424_MISSING_SDATA);
+      goto error;
+    }
 
   /* structured data part */
   if (!_syslog_format_parse_sd_column(msg, &src, &left, parse_options))
-    goto error;
+    {
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_RFC5424_INVALID_SDATA);
+      goto error;
+    }
 
   if (!_syslog_format_parse_message_column(msg, &src, &left, parse_options))
-    goto error;
+    {
+      log_msg_set_tag_by_id(msg, LM_T_SYSLOG_MISSING_MESSAGE);
+      goto error;
+    }
 
   log_msg_set_value_to_string(msg, LM_V_MSGFORMAT, "syslog:rfc5424");