Syslog Subscribers Message Format

EFA 3.1.0 introduces RFC5424 format for all notification types. Using RFC5424 flag at the subscriber level, syslog subscribers can choose the message format.

The following table summarizes the effect of the RFC5424 flag on syslog subscribers:

RFC-5424 Device Events App Events App Alerts
Enabled RFC-5424 format RFC-5424 format RFC-5424 format (Only fault-alerts will be sent)
Disabled

Legacy format

Legacy format

 Legacy format (Only legacy alerts which exists prior to 3.1.0 will be sent)
Note

Note

  1. For existing subscribers (registered in EFA 3.0.0 or earlier) RFC5424 flag is disabled after upgrading to EFA 3.1.0.
  2. For modifying the RFC5424 flag, unsubscribe or delete and re-add it. EFA 3.1.0 does not support updating the RFC5424 flag.

CLI changes

(efa:root)root@pasu-dev-server:~/build/efa# efa notification subscribers    add-syslog-relp --help
Register a new RELP syslog subscriber to the notification service.

Usage:
  efa notification subscribers add-syslog-relp [flags]

Flags:
      --address string     Address for syslog server in the format host:port (Required), Default port: 514
      --insecure           Perform insecure SSL connection and transfers. (Optional)
      --cacert string      Local path to the cacert pem file for SSL verification. (Optional, required if not insecure)
      --conn-timeout int   Timeout to open a connection to the server (Optional) (default 10)
      --filter strings     Comma separated filter values. Possible values are "DEVICE_EVENTS" - RAS/syslog events from devices, "APP_ALERTS" - fault alerts from application, "APP_EVENTS" - task events from application. If no filters are provided it means all types. E.g. --filters DEVICE_EVENTS,APP_ALERTS,APP_EVENTS. (Optional)
      --rfc5424            Enable RFC5424 message format for syslog subscribers (Optional) (default: non-RFC5424 format)
  --- Time Elapsed: 2.756476ms ---
The following example enables RFC-5424 format:
#efa notification subscribers add-syslog-relp --address 127.0.0.1:1601  --insecure --rfc5424
Successfully registered subscriber.

+----------+---------------------------------------------------------------------------+
|attribute |value                                                                      |
+----------+---------------------------------------------------------------------------+
|id        |7                                                                          |
+----------+---------------------------------------------------------------------------+
|handler   |relp                                                                       |
+----------+---------------------------------------------------------------------------+
|endpoint  |134.141.21.190:1601                                                        |
+----------+---------------------------------------------------------------------------+
|config    |{"cacert":"","conn-timeout":10,"filters":[],"insecure":true,"rfc5424":true}|
+----------+---------------------------------------------------------------------------+
Notification Subscriber ID=7
9037725-01 RevAA