Juniper Netscreen TCP Syslog messages not breaking properly

[JHill]

We are sending logs in from Juniper Netscreen Firewalls via tcp and Splunk is not properly breaking the logs and it ends up being a long message with multiple logs in the single message.

We have tried source type as syslog and tcp but does not make any difference where the messages are broken up.

I have looked at the source types but I am still not familiar at how to customize them.

Any help would be appreciated.

[jrodman · Accepted solution]

This wants to be a support ticket, with example text for support to work on. It might be as simple as configuring the tcp input to set the sourcetype.

[markushass]

Hi,

i just started evaluating splunk... and i just ran into this same issue. However it looks like the settings in the props.conf are somehow ignored. There is still one big message that is not split by the \x00 string.

Any suggestions...? Im running splunk 5.0.1 build 143156

Best regards,

Markus

[jspears]

We just started seeing the same problem when we switched to using TCP for the Netscreens. FWIW, if you're relaying through rsyslog you can fix it there.

http://www.rsyslog.com/doc/imtcp.html

[dskillman]

I haven't seen issues with Netscreen data. Did you make any tweaks to the base Netscreen config? Can you send a few lines over if non of these previous answers worked?

[Chris_R_ · Accepted solution]

You also might need to set a line breaker defined in your sourcetype as follows $SPLUNK_HOME/etc/system/local/inputs.conf

[tcp://9999]
sourcetype = juniper_syslog_stuff

And In your $SPLUNK_HOME/etc/system/local/props.conf

[junpiper_syslog_stuff]
LINE_BREAKER=(\x00)<\d+>
SHOULD_LINEMERGE=False

[BunnyHop]

I would try creating your own sourcetype. Is there a timestamp either at the beginning or the end of the line? If so, you can call for the timestamp to be the basis of the linebreak. If not, by default, the SHOULD_LINEMERGE attribute is set to false. This merges multiple lines into a single event. Set this to your props.conf file. Make sure you create a props.conf file within the %SPLUNK%/etc/system/local/ directory. Restart your splunk instance once you add this, and make sure that the sourcetype for your Juniper log is set to juniper_syslog, as specify below.

props.conf

[juniper_syslog] SHOULD_LINEMERGE = false

[jrodman · Accepted solution]

This wants to be a support ticket, with example text for support to work on. It might be as simple as configuring the tcp input to set the sourcetype.