Cisco Unified Border Element (CUBE) SBC messages not received

[mgorovoy]

When Syslog4j-based server receives a message from CUBE, it fails to create an SyslogServerEventIF object. To make matters worse, current implementation does not log any exception via exception() method of SyslogServerSessionlessEventHandlerIF.

Here is a partial exception stack of SyslogServerEvent failure from my implementation that uses the same code as AbstractSyslogServer to create an event.

Unable to handle Syslog event '<189>2345: 5678901: Mar 3 05:47:18.472: %SYS-5-CONFIG_I: Configured from console by didata on vty0 (10.1.1.1)':
java.lang.StringIndexOutOfBoundsException: begin -1, end 5, length 5
at java.base/java.lang.String.checkBoundsBeginEnd(String.java:4606) ~[?:?]
at java.base/java.lang.String.substring(String.java:2709) ~[?:?]
at java.base/java.lang.String.substring(String.java:2682) ~[?:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.hasTimeZone(SyslogServerEvent.java:160) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse8601Date(SyslogServerEvent.java:152) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:125) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:178) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:194) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.(SyslogServerEvent.java:56) ~[syslog4j-0.9.61.jar:?]

And this is a partial exception stack of SyslogStructuredServerEvent failure from my implementation that uses the same code as AbstractSyslogServer to create an event.

Unable to handle Syslog event '<189>2436: 5678901: Mar 3 05:47:18.472: %SYS-5-CONFIG_I: Configured from console by didata on vty0 (10.1.1.1)':
java.lang.IllegalArgumentException: Invalid format: "5678901:" is malformed at ":"
at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:953) ~[joda-time-2.13.0.jar:2.13.0]
at org.joda.time.DateTime.parse(DateTime.java:162) ~[joda-time-2.13.0.jar:2.13.0]
at org.joda.time.DateTime.parse(DateTime.java:150) ~[joda-time-2.13.0.jar:2.13.0]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse8601Date(SyslogServerEvent.java:156) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:125) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.structured.StructuredSyslogServerEvent.parseDate(StructuredSyslogServerEvent.java:132) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:178) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:194) ~[syslog4j-0.9.61.jar:?]
at org.graylog2.syslog4j.server.impl.event.structured.StructuredSyslogServerEvent.(StructuredSyslogServerEvent.java:59) ~[syslog4j-0.9.61.jar:?]