We have updated our Terms of Service, Code of Conduct, and Addendum.

Syslog-ng invalid frame header issue

Johan Woger
Johan Woger Posts: 16 ✭
in Stream

I was sending events to a syslog-ng server with the following config

source s_test { syslog( transport(tcp) port());};

I introduced Stream, and now I’m not seeing those logs on our syslog-ng server. Instead, I’m seeing this:

Invalid frame header; header=‘’
syslog-ng[3025832]: Syslog connection closed; fd=‘12’, client=‘AF_INET(10.1.80.158:12506)’, local=‘AF_INET(0.0.0.0:23514)’

How can I fix this?

Best Answer

  • padilla
    padilla Posts: 7 mod
    Answer ✓

    syslog-ngs "syslog()" source requires messages to begin with a byte count (octet count framing), and its not present by default from Streams Syslog destination. So, youll need to enable "Octet count framing" in the Streams Syslog destination advanced settings. Or, you could also change your source in syslog-ng from "syslog()" to "network()".

Answers

  • padilla
    padilla Posts: 7 mod
    Answer ✓

    syslog-ngs "syslog()" source requires messages to begin with a byte count (octet count framing), and its not present by default from Streams Syslog destination. So, youll need to enable "Octet count framing" in the Streams Syslog destination advanced settings. Or, you could also change your source in syslog-ng from "syslog()" to "network()".

Categories