# Logstash -\> ssl-tcp -\> syslog-ng: Invalid frame header; header=''

**URL:** <https://discuss.elastic.co/t/logstash-ssl-tcp-syslog-ng-invalid-frame-header-header/118088>\
**Category:** Logstash\
**Created:** [February 1, 2018, 7:01pm UTC](https://discuss.elastic.co/t/logstash-ssl-tcp-syslog-ng-invalid-frame-header-header/118088 "2018-02-01T19:01:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aogail](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@aogail](https://discuss.elastic.co/u/aogail)\
**Post date:** [February 1, 2018, 7:01pm UTC](https://discuss.elastic.co/t/logstash-ssl-tcp-syslog-ng-invalid-frame-header-header/118088/1 "2018-02-01T19:01:09Z")

</div>

Hello,

I am attempting to send log messages from logstash to an upstream syslog-ng server using the ssl-tcp protocol. The syslog-ng server is configured to receive messages using:

```
syslog(
  port(6514)
  transport("tls")
  so-keepalive(yes)
  so_rcvbuf(1073741824)
  log-fetch-limit(100)
  log-iw-size(100)
  max-connections(5000)
);

```

On the logstash side the output config is:

```
output {
  syslog {
    id => "siem"
    host => "..."
    port => 6514
    rfc => "rfc5424"
    protocol => "ssl-tcp"
  }
}

```

However, syslog-ng complains about an invalid frame header when logstash attempts to send messages:

```
2018-02-01T18:53:20+00:00 syslog-ng[83027]: Syslog connection accepted; fd='46', client='AF_INET(...)', local='AF_INET(0.0.0.0:6514)'
2018-02-01T18:53:20+00:00 syslog-ng[83027]: Invalid frame header; header=''
2018-02-01T18:53:20+00:00 syslog-ng[83027]: Syslog connection closed; fd='46', client='AF_INET(...)', local='AF_INET(0.0.0.0:6514)'

```

I've also tried setting rfc =\> rfc3164 which made no difference. I'm using logstash 5.6.5 and syslog-ng 3.5.6.

---

<div class="post-metadata">

**Author:** ![fekete\_robert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fekete_robert/32/23144_2.png) [@fekete\_robert](https://discuss.elastic.co/u/fekete_robert)\
**Post date:** [February 5, 2018, 2:10pm UTC](https://discuss.elastic.co/t/logstash-ssl-tcp-syslog-ng-invalid-frame-header-header/118088/2 "2018-02-05T14:10:47Z")

</div>

Hi.

On the syslog-ng side, instead of the syslog() driver, try using the network() driver with the flag(syslog-protocol) option. They handle framing differently, and might solve the problem

---

<div class="post-metadata">

**Author:** ![aogail](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@aogail](https://discuss.elastic.co/u/aogail)\
**Post date:** [February 5, 2018, 11:47pm UTC](https://discuss.elastic.co/t/logstash-ssl-tcp-syslog-ng-invalid-frame-header-header/118088/3 "2018-02-05T23:47:44Z")

</div>

Thanks for the idea. Using the network() source on the syslog-ng side does appear to work with logstash's output. In my case I added another syslog-ng instance between the two because I can't mess with the real destination's protocol without disrupting a lot of existing syslog clients.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2018, 11:47pm UTC](https://discuss.elastic.co/t/logstash-ssl-tcp-syslog-ng-invalid-frame-header-header/118088/4 "2018-03-05T23:47:48Z")

</div>

Closed on March 5, 2018, 11:47pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.