0 votes
by (1.1k points)

Trying to use Rebex Syslog Client as a replacement for SyslogNet.

Being rather a beginner in terms of the Syslog concept in general, I cannot find a way to configure Structured Data as defined in this RFC:

https://www.rfc-editor.org/rfc/rfc5424#section-6.3

While SyslogNet provides me with a class to fill StructuredDataElement elements with name value pairs, I find no way in Rebex Syslog Client.

My question

Is it possible to also send Structured Data with your library?

(If yes, how, if no, is there a hack/workaround?)

Applies to: Syslog

1 Answer

+1 vote
by (66.2k points)
selected by
 
Best answer

Unfortunately, the StructuredData are currently not supported.

The possible work around is to modify the raw syslog message data manually. It can be done like this:

// some structured-data (must conform to RFC 5424)
string structuredData = "[id1@1234 ex1=\"val1\" ex2=\"val2\"][id2@1234 ex3=\"val3\"]";

// prepare a syslog message without structured-data
var message = new SyslogMessage("Message body.")
{
    Severity = SyslogSeverity.Informational,
    Facility = SyslogFacility.User,
    ApplicationName = "Test",
    ProcessId = "123",
    MessageId = "456",
};

// get raw message representation in RFC 5424 format
var raw = Encoding.ASCII.GetString(message.Encode());

// find the last dash before the MSG part, it's the place for structured-data
int idx = raw.Length - message.Text.Length - 2;
if (raw[idx] != '-')
    throw new InvalidOperationException("Unexpected raw data.");

// construct SyslogMessage.Text with structured-data
message = new SyslogMessage(raw.Substring(0, idx) +
                            structuredData +
                            raw.Substring(idx + 1));

// set the Format to Plain to send raw data stored in the SyslogMessage.Text
client.Settings.Format = SyslogMessageFormat.Plain;

// send the message
client.Send(message);
by (1.1k points)
Thank you very much, Lukas.
...