From fb3ac50522f32569824c85f8ea59f109dd104342 Mon Sep 17 00:00:00 2001 From: pipistrello Date: Wed, 15 Jul 2026 13:03:37 +0300 Subject: [PATCH] =?UTF-8?q?Parse=20RFC3164=20(BSD)=20syslog=20in=20Alloy?= =?UTF-8?q?=20=E2=80=94=20real=20devices=20don't=20send=20RFC5424?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Confirmed via packet capture: a Yealink phone and (per RouterOS's known default behavior) the fleet's routers send classic BSD-style syslog, not RFC5424. Alloy's loki.source.syslog defaults to RFC5424-only and was silently dropping every message ("expecting a version value in the range 1-999"). syslog_format = "rfc3164" fixes it, but that argument only exists from Alloy v1.5.0 onward (confirmed empirically against v1.4.3, which fails config load) — bump the pin accordingly. v1.5.0 is an adjacent minor release, not the kind of large version jump that hit the Loki/Grafana :latest kernel-incompatibility bug fixed earlier. --- logging/alloy-config.alloy | 16 ++++++++++++---- logging/docker-compose.yaml | 6 ++++-- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/logging/alloy-config.alloy b/logging/alloy-config.alloy index 8d9dec5..88c068a 100644 --- a/logging/alloy-config.alloy +++ b/logging/alloy-config.alloy @@ -29,10 +29,17 @@ loki.relabel "syslog" { } } +// syslog_format is "rfc3164" (legacy BSD syslog, no version field) rather +// than the component's rfc5424 default — confirmed by packet capture that +// both the Yealink phones and RouterOS routers send rfc3164 in practice. +// A listener can only parse one format; if a device ever sends genuine +// rfc5424, it needs its own listener on a different port. + loki.source.syslog "network_devices_udp" { listener { - address = "0.0.0.0:514" - protocol = "udp" + address = "0.0.0.0:514" + protocol = "udp" + syslog_format = "rfc3164" labels = { job = "syslog", transport = "udp", @@ -45,8 +52,9 @@ loki.source.syslog "network_devices_udp" { loki.source.syslog "network_devices_tcp" { listener { - address = "0.0.0.0:1514" - protocol = "tcp" + address = "0.0.0.0:1514" + protocol = "tcp" + syslog_format = "rfc3164" labels = { job = "syslog", transport = "tcp", diff --git a/logging/docker-compose.yaml b/logging/docker-compose.yaml index fb8e501..c792eda 100644 --- a/logging/docker-compose.yaml +++ b/logging/docker-compose.yaml @@ -16,8 +16,10 @@ services: - logging-nw alloy: - # Pinned for the same reason as loki — see comment there. - image: grafana/alloy:v1.4.3 + # Pinned for the same reason as loki — see comment there. v1.5.0 + # specifically (not v1.4.3) because it's the first release with + # syslog_format = "rfc3164" support, needed below. + image: grafana/alloy:v1.5.0 container_name: alloy command: - run