diff --git a/plugins/inputs/syslog/README.md b/plugins/inputs/syslog/README.md index 06693bf84473b..68018cda529a4 100644 --- a/plugins/inputs/syslog/README.md +++ b/plugins/inputs/syslog/README.md @@ -2,7 +2,8 @@ The syslog plugin listens for syslog messages transmitted over [UDP](https://tools.ietf.org/html/rfc5426) or -[TCP](https://tools.ietf.org/html/rfc5425). +[TCP](https://tools.ietf.org/html/rfc6587) or +[TLS](https://tools.ietf.org/html/rfc5425), with or without the octet couting framing. Syslog messages should be formatted according to [RFC 5424](https://tools.ietf.org/html/rfc5424). diff --git a/plugins/inputs/syslog/rfc6587_test.go b/plugins/inputs/syslog/nontransparent_test.go similarity index 65% rename from plugins/inputs/syslog/rfc6587_test.go rename to plugins/inputs/syslog/nontransparent_test.go index 20ef3fdd4d193..b3dbbc4e0e48a 100644 --- a/plugins/inputs/syslog/rfc6587_test.go +++ b/plugins/inputs/syslog/nontransparent_test.go @@ -15,7 +15,7 @@ import ( "github.com/stretchr/testify/require" ) -func getTestCasesForRFC6587() []testCaseStream { +func getTestCasesForNonTransparent() []testCaseStream { testCases := []testCaseStream{ { name: "1st/avg/ok", @@ -68,13 +68,74 @@ func getTestCasesForRFC6587() []testCaseStream { Time: defaultTime, }, }, + werr: 1, + }, + { + name: "1st/min/ok//2nd/min/ok", + data: []byte("<1>2 - - - - - -\n<4>11 - - - - - -\n"), + wantStrict: []testutil.Metric{ + { + Measurement: "syslog", + Fields: map[string]interface{}{ + "version": uint16(2), + "severity_code": 1, + "facility_code": 0, + }, + Tags: map[string]string{ + "severity": "alert", + "facility": "kern", + }, + Time: defaultTime, + }, + { + Measurement: "syslog", + Fields: map[string]interface{}{ + "version": uint16(11), + "severity_code": 4, + "facility_code": 0, + }, + Tags: map[string]string{ + "severity": "warning", + "facility": "kern", + }, + Time: defaultTime.Add(time.Nanosecond), + }, + }, + wantBestEffort: []testutil.Metric{ + { + Measurement: "syslog", + Fields: map[string]interface{}{ + "version": uint16(2), + "severity_code": 1, + "facility_code": 0, + }, + Tags: map[string]string{ + "severity": "alert", + "facility": "kern", + }, + Time: defaultTime, + }, + { + Measurement: "syslog", + Fields: map[string]interface{}{ + "version": uint16(11), + "severity_code": 4, + "facility_code": 0, + }, + Tags: map[string]string{ + "severity": "warning", + "facility": "kern", + }, + Time: defaultTime.Add(time.Nanosecond), + }, + }, }, } return testCases } -func testStrictRFC6587(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { - for _, tc := range getTestCasesForRFC6587() { +func testStrictNonTransparent(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { + for _, tc := range getTestCasesForNonTransparent() { t.Run(tc.name, func(t *testing.T) { // Creation of a strict mode receiver receiver := newTCPSyslogReceiver(protocol+"://"+address, keepAlive, 0, false, false) @@ -135,8 +196,8 @@ func testStrictRFC6587(t *testing.T, protocol string, address string, wantTLS bo } } -func testBestEffortRFC6587(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { - for _, tc := range getTestCasesForRFC6587() { +func testBestEffortNonTransparent(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { + for _, tc := range getTestCasesForNonTransparent() { t.Run(tc.name, func(t *testing.T) { // Creation of a best effort mode receiver receiver := newTCPSyslogReceiver(protocol+"://"+address, keepAlive, 0, true, false) @@ -190,58 +251,58 @@ func testBestEffortRFC6587(t *testing.T, protocol string, address string, wantTL } } -func TestRFC6587Strict_tcp(t *testing.T) { - testStrictRFC6587(t, "tcp", address, false, nil) +func TestNonTransparentStrict_tcp(t *testing.T) { + testStrictNonTransparent(t, "tcp", address, false, nil) } -func TestRFC6587BestEffort_tcp(t *testing.T) { - testBestEffortRFC6587(t, "tcp", address, false, nil) +func TestNonTransparentBestEffort_tcp(t *testing.T) { + testBestEffortNonTransparent(t, "tcp", address, false, nil) } -func TestRFC6587Strict_tcp_tls(t *testing.T) { - testStrictRFC6587(t, "tcp", address, true, nil) +func TestNonTransparentStrict_tcp_tls(t *testing.T) { + testStrictNonTransparent(t, "tcp", address, true, nil) } -func TestRFC6587BestEffort_tcp_tls(t *testing.T) { - testBestEffortRFC6587(t, "tcp", address, true, nil) +func TestNonTransparentBestEffort_tcp_tls(t *testing.T) { + testBestEffortNonTransparent(t, "tcp", address, true, nil) } -func TestRFC6587StrictWithKeepAlive_tcp_tls(t *testing.T) { - testStrictRFC6587(t, "tcp", address, true, &internal.Duration{Duration: time.Minute}) +func TestNonTransparentStrictWithKeepAlive_tcp_tls(t *testing.T) { + testStrictNonTransparent(t, "tcp", address, true, &internal.Duration{Duration: time.Minute}) } -func TestRFC6587StrictWithZeroKeepAlive_tcp_tls(t *testing.T) { - testStrictRFC6587(t, "tcp", address, true, &internal.Duration{Duration: 0}) +func TestNonTransparentStrictWithZeroKeepAlive_tcp_tls(t *testing.T) { + testStrictNonTransparent(t, "tcp", address, true, &internal.Duration{Duration: 0}) } -func TestRFC6587Strict_unix(t *testing.T) { +func TestNonTransparentStrict_unix(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestStrict_unix.sock") - testStrictRFC6587(t, "unix", sock, false, nil) + testStrictNonTransparent(t, "unix", sock, false, nil) } -func TestRFC6587BestEffort_unix(t *testing.T) { +func TestNonTransparentBestEffort_unix(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestBestEffort_unix.sock") - testBestEffortRFC6587(t, "unix", sock, false, nil) + testBestEffortNonTransparent(t, "unix", sock, false, nil) } -func TestRFC6587Strict_unix_tls(t *testing.T) { +func TestNonTransparentStrict_unix_tls(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestStrict_unix_tls.sock") - testStrictRFC6587(t, "unix", sock, true, nil) + testStrictNonTransparent(t, "unix", sock, true, nil) } -func TestRFC6587BestEffort_unix_tls(t *testing.T) { +func TestNonTransparentBestEffort_unix_tls(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestBestEffort_unix_tls.sock") - testBestEffortRFC6587(t, "unix", sock, true, nil) + testBestEffortNonTransparent(t, "unix", sock, true, nil) } diff --git a/plugins/inputs/syslog/rfc5425_test.go b/plugins/inputs/syslog/octetcounting_test.go similarity index 88% rename from plugins/inputs/syslog/rfc5425_test.go rename to plugins/inputs/syslog/octetcounting_test.go index c19c7f6b226a3..77f416b6bd9e2 100644 --- a/plugins/inputs/syslog/rfc5425_test.go +++ b/plugins/inputs/syslog/octetcounting_test.go @@ -16,7 +16,7 @@ import ( "github.com/stretchr/testify/require" ) -func getTestCasesForRFC5425() []testCaseStream { +func getTestCasesForOctetCounting() []testCaseStream { testCases := []testCaseStream{ { name: "1st/avg/ok", @@ -334,8 +334,8 @@ func getTestCasesForRFC5425() []testCaseStream { return testCases } -func testStrictRFC5425(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { - for _, tc := range getTestCasesForRFC5425() { +func testStrictOctetCounting(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { + for _, tc := range getTestCasesForOctetCounting() { t.Run(tc.name, func(t *testing.T) { // Creation of a strict mode receiver receiver := newTCPSyslogReceiver(protocol+"://"+address, keepAlive, 0, false, true) @@ -396,8 +396,8 @@ func testStrictRFC5425(t *testing.T, protocol string, address string, wantTLS bo } } -func testBestEffortRFC5425(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { - for _, tc := range getTestCasesForRFC5425() { +func testBestEffortOctetCounting(t *testing.T, protocol string, address string, wantTLS bool, keepAlive *internal.Duration) { + for _, tc := range getTestCasesForOctetCounting() { t.Run(tc.name, func(t *testing.T) { // Creation of a best effort mode receiver receiver := newTCPSyslogReceiver(protocol+"://"+address, keepAlive, 0, true, true) @@ -451,58 +451,58 @@ func testBestEffortRFC5425(t *testing.T, protocol string, address string, wantTL } } -func TestRFC5425Strict_tcp(t *testing.T) { - testStrictRFC5425(t, "tcp", address, false, nil) +func TestOctetCountingStrict_tcp(t *testing.T) { + testStrictOctetCounting(t, "tcp", address, false, nil) } -func TestRFC5425BestEffort_tcp(t *testing.T) { - testBestEffortRFC5425(t, "tcp", address, false, nil) +func TestOctetCountingBestEffort_tcp(t *testing.T) { + testBestEffortOctetCounting(t, "tcp", address, false, nil) } -func TestRFC5425Strict_tcp_tls(t *testing.T) { - testStrictRFC5425(t, "tcp", address, true, nil) +func TestOctetCountingStrict_tcp_tls(t *testing.T) { + testStrictOctetCounting(t, "tcp", address, true, nil) } -func TestRFC5425BestEffort_tcp_tls(t *testing.T) { - testBestEffortRFC5425(t, "tcp", address, true, nil) +func TestOctetCountingBestEffort_tcp_tls(t *testing.T) { + testBestEffortOctetCounting(t, "tcp", address, true, nil) } -func TestRFC5425StrictWithKeepAlive_tcp_tls(t *testing.T) { - testStrictRFC5425(t, "tcp", address, true, &internal.Duration{Duration: time.Minute}) +func TestOctetCountingStrictWithKeepAlive_tcp_tls(t *testing.T) { + testStrictOctetCounting(t, "tcp", address, true, &internal.Duration{Duration: time.Minute}) } -func TestRFC5425StrictWithZeroKeepAlive_tcp_tls(t *testing.T) { - testStrictRFC5425(t, "tcp", address, true, &internal.Duration{Duration: 0}) +func TestOctetCountingStrictWithZeroKeepAlive_tcp_tls(t *testing.T) { + testStrictOctetCounting(t, "tcp", address, true, &internal.Duration{Duration: 0}) } -func TestRFC5425Strict_unix(t *testing.T) { +func TestOctetCountingStrict_unix(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestStrict_unix.sock") - testStrictRFC5425(t, "unix", sock, false, nil) + testStrictOctetCounting(t, "unix", sock, false, nil) } -func TestRFC5425BestEffort_unix(t *testing.T) { +func TestOctetCountingBestEffort_unix(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestBestEffort_unix.sock") - testBestEffortRFC5425(t, "unix", sock, false, nil) + testBestEffortOctetCounting(t, "unix", sock, false, nil) } -func TestRFC5425Strict_unix_tls(t *testing.T) { +func TestOctetCountingStrict_unix_tls(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestStrict_unix_tls.sock") - testStrictRFC5425(t, "unix", sock, true, nil) + testStrictOctetCounting(t, "unix", sock, true, nil) } -func TestRFC5425BestEffort_unix_tls(t *testing.T) { +func TestOctetCountingBestEffort_unix_tls(t *testing.T) { tmpdir, err := ioutil.TempDir("", "telegraf") require.NoError(t, err) defer os.RemoveAll(tmpdir) sock := filepath.Join(tmpdir, "syslog.TestBestEffort_unix_tls.sock") - testBestEffortRFC5425(t, "unix", sock, true, nil) + testBestEffortOctetCounting(t, "unix", sock, true, nil) } diff --git a/plugins/inputs/syslog/syslog.go b/plugins/inputs/syslog/syslog.go index b4cb2bff541f5..c7ff2dcc33d4b 100644 --- a/plugins/inputs/syslog/syslog.go +++ b/plugins/inputs/syslog/syslog.go @@ -13,9 +13,9 @@ import ( "unicode" "github.com/influxdata/go-syslog" + "github.com/influxdata/go-syslog/nontransparent" + "github.com/influxdata/go-syslog/octetcounting" "github.com/influxdata/go-syslog/rfc5424" - "github.com/influxdata/go-syslog/rfc5425" - "github.com/influxdata/go-syslog/rfc6587" "github.com/influxdata/telegraf" "github.com/influxdata/telegraf/internal" tlsConfig "github.com/influxdata/telegraf/internal/tls" @@ -33,7 +33,7 @@ type Syslog struct { MaxConnections int ReadTimeout *internal.Duration TransparentFraming bool - Trailer rfc6587.TrailerType + Trailer nontransparent.TrailerType BestEffort bool Separator string `toml:"sdparam_separator"` @@ -82,7 +82,7 @@ var sampleConfig = ` ## Whether the messages come using the transparent framing or not (default = false). ## When false messages come using non-transparent framing technique (RFC6587#section-3.4.2). - ## True means messages come using octect-counting framing technique (RFC5425#section-4.3.1). + ## True means messages come using octect-counting framing technique (RFC5425#section-4.3.1 and RFC6587#section-3.4.1). # transparent_framing = false ## The trailer to be expected in case of non-trasparent framing (default = "LF"). @@ -313,12 +313,12 @@ func (s *Syslog) handle(conn net.Conn, acc telegraf.Accumulator) { // Select the parser to use depeding on transport framing if s.TransparentFraming { - // Octet-counting transparent framing - p = rfc5425.NewParser(opts...) + // Octet counting transparent framing + p = octetcounting.NewParser(opts...) } else { // Non-transparent framing - opts = append(opts, rfc6587.WithTrailer(s.Trailer)) - p = rfc6587.NewParser(opts...) + opts = append(opts, nontransparent.WithTrailer(s.Trailer)) + p = nontransparent.NewParser(opts...) } p.Parse(conn) @@ -443,7 +443,7 @@ func init() { ReadTimeout: &internal.Duration{ Duration: defaultReadTimeout, }, - Trailer: rfc6587.LF, + Trailer: nontransparent.LF, Separator: "_", }