Network Management

Error decoding packet for Syslog RFC 3164 formatting

Error Decoding Packet Decode packet failed, packet missing starting '<' Original packet is:

First published date

10/30/2018 9:26 PM

Last published date

9/30/2020 6:55 PM

Overview

Nodes sending Syslog messages to Orion server may follow RFC 3164 formatting that the SolarWinds Syslog service cannot read by default. This article demonstrates how to enable decoding for this format in the advanced configuration page of the web console.

C:\ProgramData\Solarwinds\Logs\Orion\SyslogService.log will show log entries of this behavior below:

WARN SolarWinds.Orion.Common.SWEventLogging - Error Decoding Packet Decode packet failed, packet missing starting '<' Original packet is:

Product section

Orion Platform

Resolution

Access the advanced configuration page or the web console. See Advanced Configuration access in Orion Platform for instructions.
On the Global tab, look for EnableRfcRelay under SyslogServce.SyslogSettings
Select the checkbox and click Save.
Restart the SolarWinds Syslog Service for the changes to take effect.

More details about RFC 3164 and RFC 5424 here (content provided by Network Working Group available at https://www.ietf.org, obtained on May 20, 2019).

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.