Search code examples
rsyslog

rsyslog not escaping backslash in JSON

I have a rsyslogd instance running, producing the following JSON from syslog:

{"timegenerated":"2019-01-28T09:24:37.033990+00:00","type":"syslog","host":"REDACTED_HOSTNAME","host-ip":"REDACTED_IP","message":"<190>Jan 28 2019 10:24:35: %ASA-X-XXXXXX: Teardown TCP connection 82257709 for outside:REDACTED_IP\/REDACTED_PORT(LOCAL\ususername) to inside:REDACTED_IP\/REDACTED_PORT duration 0:01:52 bytes XXXX TCP FINs from outside (ususername)"}

This is invalid JSON, as the \ususe is interpreted as a hex representation of a unicode symbol. It should have been escaped as \\ususe.

I noticed on GitHub that there were an open issue (https://github.com/rsyslog/rsyslog/issues/1235), although it mentions another issue that resulted in a merged fix.

Here's some system info:

:~# rsyslogd -version
rsyslogd 8.24.0, compiled with:
PLATFORM:               x86_64-pc-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP:             Yes
GSSAPI Kerberos 5 support:      Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported:  Yes
64bit Atomic operations supported:  Yes
memory allocator:           system default
Runtime Instrumentation (slow code):    No
uuid support:               Yes
Number of Bits in RainerScript integers: 64

:~# lsb_release  -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 9.4 (stretch)
Release:    9.4
Codename:   stretch

Template used to create the JSON document is:

template(name="json_syslog"
  type="list") {
  constant(value="{")
    constant(value="\"timegenerated\":\"") property(name="timegenerated"    dateFormat="rfc3339")
    constant(value="\",\"type\":\"syslograw")
    constant(value="\",\"host\":\"") property(name="fromhost")
    constant(value="\",\"host-ip\":\"") property(name="fromhost-ip")
    constant(value="\",\"message\":\"") property(name="rawmsg" format="jsonr")
  constant(value="\"}\n")

Is there any functionality in rsyslog that would allow me to fix this, or does it seem like an upstream bug?

Solution

  • I notice you are using format="jsonr" in the template for the message. There is a difference if you use json instead of jsonr, which the documentation describes very briefly as avoids double escaping the value. Using a template with

    constant(value="\",\n\"json\":\"") property(name="rawmsg" format="json")
constant(value="\",\n\"jsonr\":\"") property(name="rawmsg" format="jsonr")

    and providing input containing

    LOCAL\ususer "abc"

    produces the 2 lines

    "json":"LOCAL\\ususer \"abc\",
"jsonr":"LOCAL\ususer \"abc\",

    in which the json format has escaped the \u into \\u (tested with rsyslog-8.27.0). If this is not right for you, you can always manipulate the message, for example as follows, adding before your action:

    set $.msg2 = replace($rawmsg, "\\u", "\\\\u");

    and in your template use

    constant(value="\",\"message\":\"") property(name="$.msg2" format="jsonr")

    The replace function does a global replace, so you may want to restrict it, for example with

    set $.msg2 = replace($rawmsg, "LOCAL\\u", "LOCAL\\\\u");