Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

How to prevent : "Value names cannot be longer than 255 characters, this value will always expand to the empty string;" #2297

Closed
ehlo550 opened this issue Dec 22, 2023 · 7 comments · Fixed by #2579
Closed

How to prevent : "Value names cannot be longer than 255 characters, this value will always expand to the empty string;" #2297

ehlo550 opened this issue Dec 22, 2023 · 7 comments · Fixed by #2579
Assignees
@ikheifets-splunk @mstopa-splunk
Labels
Application core dependency in sc4s bug Something isn't working

Comments

@ehlo550
Copy link
Contributor

ehlo550 commented Dec 22, 2023

Was the issue replicated by support?
yes.

What is the sc4s version ?
2.48

Is there a pcap available?
yes.

Is the issue related to the environment of the customer or Software related issue?
it's related to syslog-ng/sc4s configuration

Describe the bug
When I am sending a specific message to sc4s I get sort of an "error" more of an informational message logged from sc4s that

- - syslog-ng 158 - [meta sequenceId="43428"]Value names cannot be longer than 255 characters, this value will always expand to the empty string; value='.values.XXXXXXXXXXXXX'

the content that was replaced with XXXXXXXX is base64 encoded and ends with a = character in the original message.

how can i get rid of these error messages?

I am sure that some parser is used on this message and due to the value ending with a = sc4s is trying to use everything before it as a key and everything after as value.

I assume I simply need to add an app parser to stop this behaviour.
Belows message is just an example, so this is a general question and independent of sourcetype/vendor_product.
Splunk Support told me to open an issue here.

To Reproduce
Steps to reproduce the behavior:

  1. send example message to sc4s echo "<13>Nov 08 12:59:54 1.1.1.1 f5req_forward_clone[-]: F5-REQ-VERSION:v1:date_time='2023-11-08 13:59:54',clientip='1.2.2.2',host='[host.example.com](https://host.example.com/)' ,http_host='[host.example.com](https://host.example.com/)',http_responsecode='200',http_username='makemelongenoughtotriggerAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABASE64CONTENTendingwitha=',http_user-agent='PHP-SOAP-CURL',http_referer='',http_xff='3.3.3.3',http_request_id='',cached='false',virtualname='something',virtualip='4.4.4.4',virtualport='443',http_method='POST',http_path='/bla/blub.asmx',http_query='',http_version='HTTP/1.1',http_response_size='10092',http_response_time='32',nodeip='4.4.4.4',nodeport='443',snatpool='/Common/SNAT_Something_Pool',snatip='6.6.6.6',snatport='34470',pool='/Common/blub.app/blapool8',req_type='response'" | nc -u -w 0 {SC4S_IP} 514
@ikheifets-splunk ikheifets-splunk self-assigned this Dec 27, 2023
@ikheifets-splunk
Copy link
Contributor

Hello, @ehlo550 !
Thanks, for the issue. I reproduced this bug. It's very tricky bug and I will let you know about progress

@ehlo550
Copy link
Contributor Author

ehlo550 commented Jan 10, 2024

Hi @ikheifets-splunk,
Thank you for confirmation.

Regards
Stefan

@xenogloss
Copy link

I have the same issue.. For now I use "Ingest Actions" to remove them

@ikheifets-splunk
Copy link
Contributor

ikheifets-splunk commented Feb 12, 2024 •
edited
Loading

Hello, @ehlo550 @xenogloss !

Sorry for delay! This error Value names cannot be longer than 255 characters, this value will always expand to the empty string; related with https://github.com/syslog-ng/syslog-ng . I already had direct conversation with syslog-ng author. I not sure that we can fix it very fast.

But I will think probably we can make workaround for this case

@rjha-splunk rjha-splunk added bug Something isn't working Application core dependency in sc4s labels Jul 31, 2024
@mstopa-splunk
Copy link
Contributor

Hi @ehlo550, the error you're seeing is generated by syslog-ng and cannot be controlled at the SC4S level, especially since it's currently expected behavior for syslog-ng to check strings ending with equal signs as value names. We have opened a GitHub issue in the syslog-ng repository for this. As a quick workaround, you might consider filtering out syslog-ng errors related to the 255-character rule. You can find more details here: https://splunk.github.io/splunk-connect-for-syslog/main/sources/#filtering-events-from-output.

for example:

block parser sc4s_log-postfiler() {
    channel {
        rewrite(r_set_dest_splunk_null_queue);
   };
};

application sc4s_log-postfiler[sc4s-postfilter] {
 filter {
        "${fields.sc4s_vendor}" eq "splunk" and
        "${fields.sc4s_product}" eq "sc4s"
        and message('Value names cannot be longer than 255 characters');
    };
    parser { sc4s_log-postfiler(); };
};

@mstopa-splunk
Copy link
Contributor

Reopening as bug based on the discussion in syslog-ng/syslog-ng#5059

We need to fix parsing in package/etc/conf.d/conflib/syslog/app-syslog-fortigate_fortiweb.conf and package/etc/conf.d/conflib/syslog/app-syslog-fortigate_fortios.conf.

In both these parsers there is no filter in front of kv-parser which is then used without pair-separator.
I checked that without these two parsers SC4S doesn't send the warning

@mstopa-splunk mstopa-splunk reopened this Sep 5, 2024
@mstopa-splunk mstopa-splunk mentioned this issue Sep 11, 2024
Merged
@mstopa-splunk
Copy link
Contributor

fixed in SC4S 3.31.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ikheifets-splunk ikheifets-splunk

@mstopa-splunk mstopa-splunk

Labels
Application core dependency in sc4s bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: filter fortigate splunk/splunk-connect-for-syslog
5 participants
@ehlo550 @rjha-splunk @xenogloss @ikheifets-splunk @mstopa-splunk