Syslog RFC5424 MSGID and MSG not split

edit

This is worthy of a bug/Enhancement request on the Wireshark Gitlab issues.

rfc3164:

The full format of a syslog message seen on the wire has three discernable parts. The first part is called the PRI, the second part is the HEADER, and the third part is the MSG.

rfc5424:

      SYSLOG-MSG      = HEADER SP STRUCTURED-DATA [SP MSG]

      HEADER          = PRI VERSION SP TIMESTAMP SP HOSTNAME
                        SP APP-NAME SP PROCID SP MSGID

There should be a field for header - see (Wireshark dfref - syslog).

In the decode below, version, timestamp, hostname, app-name, procid and msgid are all lumped into syslog.msg. They belong in the non-existent syslog.header field.
And per RFC5424, since the STRUCTURED-DATA field is nil (-), everything after the space following it should go into the syslog.msg field.

Frame 2: 160 bytes on wire (1280 bits), 160 bytes captured (1280 bits) on interface unknown, id 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.3
User Datagram Protocol, Src Port: 40175, Dst Port: 514
Syslog message: AUTHPRIV.INFO: 1 2019-03-18T15:15:38.467246+01:00 uhei-t-ntr001 sudo - - -  pam_unix(sudo:session): session closed for user root\n
    0101 0... = Facility: AUTHPRIV - security/authorization messages (private) (10)
    .... .110 = Level: INFO - informational (6)
    Message: 1 2019-03-18T15:15:38.467246+01:00 uhei-t-ntr001 sudo - - -  pam_unix(sudo:session): session closed for user root\n
        Syslog version: 1
        Syslog timestamp: Mar 18, 2019 14:15:38.467246000 UTC
        Syslog hostname: uhei-t-ntr001
        Syslog app name: sudo
        Syslog process id: -
        Syslog message id: - -  pam_unix(sudo:session): session closed for user root\n

        Syslog message id: - -  pam_unix(sudo:session): session closed for user root\n

Should be:

        Syslog message id: -
    Structured Data: -
    Message: pam_unix(sudo:session): session closed for user root\n