We have a problem! ( RRD 2026 Patch3 )
In the syslog server configuration, if you have multiple entries, as shown in the attached figure, the log stream is always sent only to the first entry specified.
However, the correct operation would be to send the logs to all configured entries.
The test was performed using tcpdump.
Could you please verify and patch if necessary, as it is vital to send the logs to multiple sources, such as SIEMs, etc., to comply with current regulations (Italy).
I hope you have added all syslog servers at a time and clicked ok. May be you can test once by adding the one server at a time and save by clicking ok and adding next server.
I know This is weird, Just wanted to check whether Read values from Data table is the issue. We will try to fix it in next patch.
I hope you have added all syslog servers at a time and clicked ok. May be you can test once by adding the one server at a time and save by clicking ok and adding next server.
I know This is weird, Just wanted to check whether Read values from Data table is the issue. We will try to fix it in next patch.
Hi Pavan,
Hi Pavan,
I ran several tests. The syslog servers were obviously added both simultaneously and then given the OK, and added one by one, but the result remains the same. Only the first syslog server receives the logs. This was verified using tcpdump. The test is simple. Configure two syslog servers and you'll see that when sniffing traffic, they only reach the first one in the list. Reverse the order of the two syslog servers and you'll see that the logs reach the one previously seen as secondary.
ETA for next patch? Thanks.
I have setup environment like 2 syslog servers, its working fine for me. We will try to more logging and see
Do you see any windows Event logs in Client machine related to syslog server.
Reg ETA, we are working on one major issue, we will try to fix as soon as possible.
Hi Pavan, sorry for the delayed reply.
In the meantime, I applied patch 4 and verified today that log transmission to the various syslog servers is working correctly—and it is.
Could this have been caused by the connection history table failing previously, with everything returning to normal operation after it was restored?
I also wanted to ask about something—I'm posting this in the feature request thread as well.
It concerns the ability to configure specific settings for each syslog server: the protocol to use (TCP or UDP), the format (RFC3164, RFC5424, Custom), the message prefix, the delimiter, and the spacing before and after the delimiter. The reason is that if you set parameters globally for all syslog servers, there is no guarantee they all support the same ones.
This can certainly affect proper operation—for instance, if you send the same logs to two SIEMs that support different formats, applying the same parameters to both could break the parser on one of them.
Yeah it could have caused by connection history issue as well.
Reg Feature request, I get what you are talking about. having different config for each syslog server. We will check what can be done.
Hi Pavan,
Yes, I also think it was due to the connection history issue.
Regarding the request—yes, that’s correct.
It would be great to have different configurations for each syslog server.
As I mentioned, one SIEM might support a specific format or protocol (TCP or UDP) while another doesn't.
In our specific case, we forward logs to three different SIEMs.
The current configuration works for two of them, but the third requires UDP and a format other than the configured RFC5424—specifically, it works with RFC3164 and UDP.
Thanks.
