Syslog-ng invalid frame header issue

I was sending events to a syslog-ng server with the following config

source s_test { syslog( transport(tcp) port());};

I introduced Stream, and now I’m not seeing those logs on our syslog-ng server. Instead, I’m seeing this:

Invalid frame header; header=‘’
syslog-ng[3025832]: Syslog connection closed; fd=‘12’, client=‘AF_INET(’, local=‘AF_INET(’

How can I fix this?

syslog-ng’s “syslog()” source requires messages to begin with a byte count (octet count framing), and it’s not present by default from Stream’s Syslog destination. So, you’ll need to enable “Octet count framing” in the Stream’s Syslog destination advanced settings. Or, you could also change your source in syslog-ng from “syslog()” to “network()”.

1 UpGoat