Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.
Does QRadar's syslog server support syslog messages over TCP formatted as defined in RFC 6587? My own observation suggest not. The messages are not parsed correctly. The size of the message as defined in the RFC is assumed to be part of the syslog message instead of being metadata. Multiple messages are not split according to their size.
Hello,
As far as I know, QRadar does not support Octet counting for TCP syslog (RFC 6587) and hence this RFC is not supported.
Another useful thread here: https://www.ibm.com/mysupport/s/question/0D50z00006PEInc/syslog-format-changes-in-events-payload?language=en_US