 | 1 | initial version |
This is worthy of a bug/Enhancement request on the Wireshark Gitlab issues.
rfc3164:
The full format of a syslog message seen on the wire has three discernable parts. The first part is called the PRI, the second part is the HEADER, and the third part is the MSG.
SYSLOG-MSG = HEADER SP STRUCTURED-DATA [SP MSG]
HEADER = PRI VERSION SP TIMESTAMP SP HOSTNAME
SP APP-NAME SP PROCID SP MSGID
There should be a field for header - see (Wireshark dfref - syslog).
In the decode below, version, timestamp, hostname, app-name, procid and msgid are all lumped into syslog.msg. They belong in the non-existent syslog.header field.
And per RFC5424, since the STRUCTURED-DATA field is nil (-), everything after the space following it should go into the syslog.msg field.
Frame 2: 160 bytes on wire (1280 bits), 160 bytes captured (1280 bits) on interface unknown, id 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.3
User Datagram Protocol, Src Port: 40175, Dst Port: 514
Syslog message: AUTHPRIV.INFO: 1 2019-03-18T15:15:38.467246+01:00 uhei-t-ntr001 sudo - - - pam_unix(sudo:session): session closed for user root\n
0101 0... = Facility: AUTHPRIV - security/authorization messages (private) (10)
.... .110 = Level: INFO - informational (6)
Message: 1 2019-03-18T15:15:38.467246+01:00 uhei-t-ntr001 sudo - - - pam_unix(sudo:session): session closed for user root\n
Syslog version: 1
Syslog timestamp: Mar 18, 2019 14:15:38.467246000 UTC
Syslog hostname: uhei-t-ntr001
Syslog app name: sudo
Syslog process id: -
Syslog message id: - - pam_unix(sudo:session): session closed for user root\n
Syslog message id: - - pam_unix(sudo:session): session closed for user root\n
Should be:
Syslog message id: -
Structured Data: -
Message: pam_unix(sudo:session): session closed for user root\n