Skip to content

app/vlinsert/syslog: fix embedded newline in TCP syslog corrupting the next message#1564

Open
func25 wants to merge 4 commits into
masterfrom
fix-malformed-syslog
Open

app/vlinsert/syslog: fix embedded newline in TCP syslog corrupting the next message#1564
func25 wants to merge 4 commits into
masterfrom
fix-malformed-syslog

Conversation

@func25

@func25 func25 commented Jul 1, 2026

Copy link
Copy Markdown
Member

Fixes #1365

A syslog message sent over TCP with an embedded newline could corrupt the next message. This is a known limitation of octet stuffing (see RFC 6587 §3.4.2). VictoriaLogs cannot avoid splitting such a message, but it should not let the leftover corrupt the next message and should handle it gracefully, as it already does for other malformed input.

Fixed by peeking the first byte to detect the framing method and reading each octet-stuffing frame up to its LF, so a frame can no longer leak into the next one. Also replaces the goto with a plain loop and drops the redundant prefix scan/copy, so the path does fewer reads per message.

+, syslog ingestion is best-effort to cover many weird cases of old syslog, so I don't think warning logs are needed here.

In the reported case, before

_msg: "Apr 29 17:43:00 ..."
_msg: ")\n<11>Apr 29 17:43:00 ..." # corrupted

after

_msg: "Apr 29 17:43:00 ..."
_msg: ")"  # bogus fragment isolated
_msg: "Apr 29 17:43:00 ..." # correctly parsed

@func25
func25 marked this pull request as ready for review July 2, 2026 12:52
@func25
func25 requested review from cuongleqq and vadimalekseev July 2, 2026 12:56

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 1 file (changes from recent commits).

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread docs/victorialogs/CHANGELOG.md Outdated
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Signed-off-by: Phuong Le <39565248+func25@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ingestion: embedded newlines in TCP syslog messages split into bogus fragments

1 participant