Syslog Server Access to Structured Data

Question

A now departed developer identified the rebex syslog library as being suitable for our development needs and implemented a service based around the server code not spotting that the Structured-Data element of a received message is not exposed and this is now presenting a problem!

This question discussed similar issues with the syslog client and you were able to provide a workaround based on the encoding of a message.

I cant figure out anything similar for inbound messages - as this does form a part of RFC5424 which is the modern format of the syslogmessageformat can you expose the message part that has been skipped during your parsing to get to the final MSG (Your text field) or at least the raw message to allow our own parsing to be performed?

Thanks

Answer 1

In default scenario, if the SyslogServer class receives a message in RFC5424 format, the structured data are part of the SyslogMessage.Text property.

For example, if I use sample code from the other question, content of the received SyslogMessage.Text property is following:

[id1@1234 ex1="val1" ex2="val2"][id2@1234 ex3="val3"] Message body.

The two leading [...][...] are structured data of the RFC5424 message.

---

If you prefer to parse the received message on your own, you can easily do it by setting SyslogBinding.Format to either Plain or Legacy whichever is more suitable for you. It can be done like this:

var binding = new SyslogBinding(...){ Format = SyslogMessageFormat.Plain };
server.Bind(binding);

or

var binding = server.Bind(...);
binding.Format = SyslogMessageFormat.Plain;

In this case, the server does not parse the message - the whole message data are accessible using the SyslogMessage.Text property.

Note: If you choose Legacy instead Plain format, only the <PRI> part of the syslog message is parsed, the Facility and Severity properties are filled, the <PRI> value will not be part of the SyslogMessage.Text property.

Comments

Thanks Lukas, life saver!