solzimer / nsyslog-parser Goto Github PK

Consider the following code :

const parser = require("nsyslog-parser");
console.log(parser('<15>1 2021-05-06T08:02:30.282938Z host APP 1000 l [c q="x"]').structuredData);
console.log(parser('<15>1 2021-05-06T08:02:30.282938Z host APP 1000 l [c q="\\""]').structuredData);

It generates the following output:

[ { '$id': 'c@0', q: 'x' } ]
[]

Where it should be generating this:

[ { '$id': 'c@0', q: 'x' } ]
[ { '$id': 'c@0', q: '"' } ]

The RFC5424 states that :
Inside PARAM-VALUE, the characters '"' (ABNF %d34), '\' (ABNF %d92), and ']' (ABNF %d93) MUST be escaped.

Nevertheless, the parsing does not seem to properly parse escaped double-quotes inside SD values.

Through the docker syslog backend configured to do RFC5424 we see messages like:

'<30>1 2018-06-24T22:22:53Z my.test.com testapp 26599 testapp - This: contains two : colons'

Unfortunately the parsed message then contains only:

contains two : colons

Where the initial This: is removed.

input:

<30>Aug  4 16:53:13 pinger[1334]: 64 bytes from 87.250.250.242: seq=69 ttl=37 time=33.918 ms\n

output:

{ originalMessage: '<30>Aug  4 16:53:13 pinger[1334]: 64 bytes from 87.250.250.242: seq=69 ttl=37 time=33.918 ms\n',
pri: '<30>',
prival: 30,
facilityval: 3,
levelval: 6,
facility: 'daemon',
level: 'info',
type: 'BSD',
ts: 2018-08-04T16:53:13.000Z,
message: 'pinger[1334]: 64 bytes from 87.250.250.242: seq=69 ttl=37 time=33.918 ms\n',
chain: [],
host: '',
fields: [],
header: '<30>Aug  4 16:53:13 ' }

Check message property. This log entry produced by docker.

There escaping doesn't seem consistent with [the CEF standard].(https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/78000/KB78712/en_US/CEF_White_Paper_20100722.pdf)

For example, there's no | character escaping in the prefix fields. There's also no '=' escaping in the extension fields. The following:

CEF:0|security|threatmanager|1.0|100|detected a = in message|10|src=10.0.0.1 act=blocked a \\= dst=1.1.1.1 

produces the fields:

  "fields": {
    "src": "10.0.0.1",
    "act": "blocked a",
    "\\": "",
    "dst": "1.1.1.1"
  },

When it should, I think, produce:

  "fields": {
    "src": "10.0.0.1",
    "act": "blocked a \\",
    "dst": "1.1.1.1"
  },

By default the logger executable sends some RFC5424 structured data fields (see http://kerolasa.github.io/logger.html for details) which seem not to be recognized by the parser. Notice especially the 'messageandheader` property.

logger "test message from logger"

results in the following parser output

{ date: '2020-02-02T12:55:52.333Z',
  host: 'nuc',
  message:
   'tzKnown="1" isSynced="1" syncAccuracy="77000"] test message from logger',
  protocol: 'IPv4',
  originalMessage:
   '<13>1 2020-02-02T13:55:52.332998+01:00 nuc standa - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="77000"] test message from logger',
  pri: '<13>',
  prival: 13,
  facilityval: 1,
  levelval: 5,
  facility: 'user',
  level: 'notice',
  version: 1,
  type: 'RFC5424',
  ts: '2020-02-02T12:55:52.332Z',
  appName: 'standa',
  pid: '-',
  messageid: '-',
  structuredData: [],
  chain: [],
  fields: [],
  header:
   '<13>1 2020-02-02T13:55:52.332998+01:00 nuc standa - - [timeQuality ' }