# Mezmo: Major incident: Some logs submitted over syslog using custom ports are not being correctly formatted and are not available for Alerting, Searching, Timelines, Graphs, and Live Tail.

**Summary:** Mezmo reported a major Log Ingestion (Syslog) outage affecting some custom-port logs, making them unavailable for Alerting, Searching, Timelines, Graphs, and Live Tail; logs not using custom ports worked normally. It started at 2022-02-16 19:58 UTC and resolved at 2022-02-16 21:56 UTC (1 h 57 min). A fix was implemented. _(machine-written, sol)_
- Kind: Major incident · Label: outage (model (Jev))
- Changed: 2022-02-16 19:58 UTC · Detected: 2026-10-17 18:22 UTC
- [Source: https://stspg.io/g1chlxpmd7n2](https://stspg.io/g1chlxpmd7n2)
- [Company: Mezmo](https://rewindex.com/company/mezmo.md)
- Versions: before (none: first archived) → after incident\_version:282/9jbwxcyyb6f8@4033bebea0e2
- Change 1 of 1 for this incident

## What changed

**1. Added: Title**

```diff
+ Some logs submitted over syslog using custom ports are not being correctly formatted and are not available for Alerting, Searching, Timelines, Graphs, and Live Tail.
```

**2. Added: Impact**

```diff
+ major
```

**3. Added: Status**

```diff
+ postmortem
```

**4. Added: Start time**

```diff
+ 2022-02-16 19:58 UTC
```

**5. Added: Resolved time**

```diff
+ 2022-02-16 21:56 UTC
```

**6. Added: Affected components**

```diff
+ Log Ingestion (Syslog)
```

**7. Added: Update** (investigating) · 2022-02-16 19:58 UTC

```diff
+ Some logs being sent to our service over syslog using custom ports are not being correctly parsed and are not available for Alerting, Searching, Timelines, Graphs, and Live Tail.  Unparsable log lines will show the error “Unidentifiable Syslog Source” and “Unsupported syslog format.”  Logs being sent over syslog that do not use custom ports are working normally.
```

**8. Added: Update** (monitoring) · 2022-02-16 21:17 UTC

```diff
+ A fix has been implemented and we are monitoring the results.
```

**9. Added: Update** (resolved) · 2022-02-16 21:56 UTC

```diff
+ The incident has been resolved. If you continue to experience issues with unparsable log lines that show the error “Unidentifiable Syslog Source” and “Unsupported Syslog format”, please contact Support.
```

**10. Added: Update** (postmortem) · 2022-03-01 20:13 UTC

```diff
+ **Dates:**      Start Time: Wednesday, February 16, 2022 at 19:58 UTC     End Time: Wednesday, February 16, 2022 at 21:10 UTC     Duration: 1:12:00 **What happened:** Some logs being sent to our service over syslog using custom ports were not being correctly parsed and were not available for Alerting, Searching, Timelines, Graphs, and Live Tail.  Unparsable log lines showed the error “Unidentifiable Syslog Source” and “Unsupported syslog format.”  Logs being sent over syslog that do not use custom ports were working normally. ‌ **Why it happened:** We introduced a bug into our production environment, specifically in a new service called Syslog Forwarder.  The bug prevented Syslog lines from being parsed. As a result, any newly submitted Syslog lines sent using custom ports were not parsed.  The lines displayed an error “Unidentifiable Syslog Source” and “Unsupported syslog format.” ‌ **How we fixed it:** We created a hot fix that corrected the bug.   **What we are doing to prevent it from happening again:** We added to our test suite to guard against regressions in the Syslog Forwarder.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2022-02-16 19:58 UTC | Major incident: Some logs submitted over syslog using custom ports are not being correctly formatted and are not available for Alerting, Searching, Timelines, Graphs, and Live Tail. (this change) | outage |

All Mezmo changes: [timeline](https://rewindex.com/company/mezmo/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/i6eb9a51275dc47 · Markdown: https://rewindex.com/change/i6eb9a51275dc47.md · JSON: https://rewindex.com/api/v1/changes/i6eb9a51275dc47 · Generated 2026-10-18T03:28:49.115Z