This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Graylog not accepting syslog data from UTM 9 due to datetime issues

Hi guys,

we are using Graylog 5 / OpenSearch 2.1 and want to ingest UTM 9 logfile data. Unfortunately the transmitted datetime format is not as the syslog RFC requests (FULL-DATE "T" FULL-TIME, see https://www.rfc-editor.org/rfc/rfc5424 ) so Graylog can't handle them. I cant find any option to change this in UTM management console and changing the syslog-ng.conf doesnt help either because it get's overwritten by UTM as soon as the server or syslog service restarts.

Anyone here who had the same issue and somehow solved it, please? There is an extractor someone already built to import the data by using an Graylog extractor ( https://community.graylog.org/t/graylog-sophos-utm-9-extractors/23122 ) but I'm wondering if there is also another solution. And, if possible, this could be solved with a patch. Slight smile

Cheers,
Klaus



This thread was automatically locked due to age.
Parents
  • Hi Klaus,
    At which format the date is sent?
    I've seen different systems (splunk, kiwi, prolog,...) without problems.
    Possible you can send your data to a standard(linux) syslogserver, which forward the data with needed format..?


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • Hi Dirk,

    thanks for your reply. The datetime format UTM 9 is using is "2022:12:29-11:46:36" while the syslog RFC says it should be "2022:12:29T11:46:36".

    There are ways to workaround this issue, yes - I already found a working solution by using Graylog extractors. I still think the correct syslog datetime should be applied to the UTM logfiles even if other syslog solutions dont have that problem?

    Cheers and a happy New Year,

    Klaus

Reply
  • Hi Dirk,

    thanks for your reply. The datetime format UTM 9 is using is "2022:12:29-11:46:36" while the syslog RFC says it should be "2022:12:29T11:46:36".

    There are ways to workaround this issue, yes - I already found a working solution by using Graylog extractors. I still think the correct syslog datetime should be applied to the UTM logfiles even if other syslog solutions dont have that problem?

    Cheers and a happy New Year,

    Klaus

Children
  • Do you use the "UTM log files" ... or syslog?

    Some time ago I learned how to configure a large enterprise management solution by configuring the connectors to accept the "little differences". So the connectors (or the graylog extractor) can be an absolutely typical "workaround".

    You can speak to your partner/Sophos representative and create a feature request. But since development with SG/UTM is very limited at the moment... I think you are unsuccessful.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.