Skip to main content

Syslog/CEF Over TCP Shows No Events in Live Data When Sender Uses NUL-Delimited Records

  • September 12, 2026
  • 0 replies
  • 2 views
Jessica Bracken

Symptom

You have a Syslog source in Cribl Stream that shows zero events in Live Data, even though the source looks healthy and the connection is established.

Running tcpdump on the Stream worker confirms that syslog-style messages are arriving over TCP on the expected port (for example, 6514). The TCP session stays open and you can see readable log text in the capture.

There are no obvious errors in the Cribl UI for this source, and other syslog sources on the same worker are ingesting normally.

When you look more closely at the packets (for example, with tcpdump -A or tcpdump -xx), each record appears to end with a NUL (0x00) byte instead of a newline. This is common with some SIEM agents that send CEF (Common Event Format) over TCP (for example, Powertech SIEM Agent on IBM AS400 and use NUL as a record separator.

What is CEF?

CEF (Common Event Format) is a log format that standardizes security and event data into a header plus key-value pairs. The header identifies the vendor, product, and event type, and the key-value pairs (for example, src= and dst=) carry structured details such as IP addresses and user information.

Environment

  • Cribl Stream
  • Syslog-style events (for example, CEF-formatted security events) sent over TCP to a Stream worker
  • Upstream sender uses ASCII NUL (0x00) as the record delimiter on the TCP stream instead of newline or RFC-standard syslog framing
  • Cribl Stream configured with a TCP (Raw) source that uses a Regex Event Breaker ruleset to split events on the NUL delimiter

Resolution

1. Verify that data is arriving and identify the delimiter.

  1. On the worker node that receives this feed, run a short packet capture on the syslog port, for example:

    sudo tcpdump -n -A -i any port <tcp_port>

  2. Trigger a few test events from the sender (for example, generate a couple of authentication failures on the source system).

  3. In the capture, confirm both of the following:

    • The payload contains CEF or syslog-like text, such as:

      • Each record is followed by a NUL (0x00) byte rather than a newline at the end.

    CEF:0|Powertech|SIEM Agent|4.3|TPW0021|...|6|src=10.x.x.x dst=10.x.x.x

2. Create an Event Breaker ruleset for NUL-delimited records.

  1. In the Cribl UI for the worker group, go to Processing → Knowledge → Event Breaker Rulesets.

  2. Click Add Ruleset and give it a descriptive name, for example: nul_delimited_cef_over_tcp.

  3. Add a single rule and configure it as follows:

    • Rule type: Regex

    • Pattern: a pattern that matches the NUL character (ASCII 0x00) and treats that character as the event break point.

  4. This tells Stream to break events whenever it encounters a NUL byte and to drop that delimiter, so each CEF/syslog record becomes a clean, separate event.

Optional alternative: Instead of breaking on the NUL character, you can configure a Regex rule that breaks right before the syslog PRI token (for example, before a string like <38>) so that each new PRI starts a fresh event.

3. Create a TCP (Raw) source for the feed.

  1. Go to Data → Sources and click Add Source.

  2. Choose TCP (Raw).

  3. Configure:

    • Address: 0.0.0.0 (or a specific interface if you prefer to bind to one)

    • Port: The TCP port used by the sender (for example, 6514)

  4. Under Processing Settings → Event Breakers:

    • Set Event Breaker rulesets to the ruleset you created in step 2 (for example, nul_delimited_cef_over_tcp).

  5. Commit and deploy the configuration to the worker group that receives this traffic.

4. Route the new source through your existing pipelines and destinations.

  1. Open Routes and add or update a route that matches the new TCP (Raw) source’s input ID (for example, a condition that matches __inputId for this source).

  2. Attach the same pipeline(s) and destinations you were using for the original Syslog source, unless you intentionally want a different path for this data.

  3. Commit and deploy the route changes so that events from the new source flow through the expected pipelines and outputs.

5. Confirm that events now appear in Live Data and at the destination.

  1. Open the new TCP (Raw) source in the UI and start a Live Data capture.

  2. Generate another small set of test events from the sender.

  3. Verify that:

    • Each CEF/syslog record shows up as a single, complete event (no truncation at the end of the line).

    • Downstream destinations (for example, a SIEM) receive the same events when the pipeline forwards them.

  4. Once you’ve confirmed everything is flowing correctly, you can disable or remove the original Syslog source that was not producing events.

Cause

This issue can be caused by non-RFC syslog framing on a TCP stream. In this pattern, the sender emits CEF (Common Event Format) records over TCP and terminates each record with a NUL (0x00) byte instead of a newline or proper RFC3164/5424 framing.

Stream’s Syslog source expects standard syslog framing; when it receives a continuous TCP stream with NUL-terminated records, it may never recognize a complete, valid syslog message boundary. As a result, no events are emitted into Live Data, even though packet captures clearly show data arriving on the port.

Switching to a TCP (Raw) source with a Regex Event Breaker that splits on the NUL delimiter lets Stream frame each record correctly as its own event.

Terms & ConditionsAccessibility statement