title: Malformed Syslog Packet when using LEEF format
body: <p>I'm using SyslogNet library to send SIEM Syslog message from my app to 3rd party vendors SIEM system in LEEF format (in this it's QRadar).
  However, I the message doesn't get sent and nowhere the procedure produce any exception.
  I can see and confirm that the string correlates to the correct template/format according to Rfc5424 for LEEF messages (see example below the code).</p>
  
  <p>The only indication that the message was not sent properly is a WireShark trace showing the that the message was consisted of only a few bytes and more importantly is considered a malformed packet:</p>
  
  <p><a href="https://i.stack.imgur.com/LesAo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LesAo.png" alt="Wireshark Trace"></a></p>
  
  <p><strong>The code is as follows:</strong></p>
  
  <pre><code>using System.IO;
  using System.Text;
  using System.Reflection;
  using SyslogNet.Client;
  using SyslogNet.Client.Serialization;
  using SyslogNet.Client.Transport;
  using Severity = SyslogNet.Client.Severity;
  
  namespace Providers.Syslog
  {
  public class SyslogLogger
  {
  
      private readonly SyslogSettings _syslogSettings;
      private readonly SyslogUdpSender _syslogUdpSender;
  
      public SyslogLogger(SyslogSettings syslogSettings)
      {
          _syslogSettings = syslogSettings;
          _syslogUdpSender = new SyslogUdpSender(syslogSettings.SyslogServerName, syslogSettings.SyslogServerPort);
      }
  
      public void Log(string message)
      {
          var syslogMessage = new SyslogMessage(
              null,
              (Facility)_syslogSettings.Facility,
              Severity.Informational,
              null,
              _syslogSettings.Identity,
              message);
          _syslogUdpSender.Send(syslogMessage, new SyslogMessageSerializer());
      }
  
      private class SyslogMessageSerializer : SyslogMessageSerializerBase, ISyslogMessageSerializer
      {
          private const int AppNameMaxLength = 32;
  
          public void Serialize(SyslogMessage message, Stream stream)
          {
              var priorityValue = CalculatePriorityValue(message.Facility, message.Severity);
  
              string timestamp = null;
              if (message.DateTimeOffset.HasValue)
              {
                  var dt = message.DateTimeOffset.Value;
                  var day = dt.Day &lt; 10 ? " " + dt.Day : dt.Day.ToString();
                  timestamp = string.Concat(dt.ToString("MMM "), day, dt.ToString(" HH:mm:ss"));
              }
  
              var headerBuilder = new StringBuilder();
              headerBuilder.Append("&lt;").Append(priorityValue).Append("&gt;");
              if (!string.IsNullOrEmpty(timestamp))
              {
                  headerBuilder.Append(timestamp).Append(" ");
              }
              if (!string.IsNullOrEmpty(message.HostName))
              {
                  headerBuilder.Append(message.HostName).Append(" ");
              }
  
              if (!message.Message.IsSiemOrientadTemplate())
              {
                  var appName = message.AppName;
                  headerBuilder.Append(string.IsNullOrWhiteSpace(appName)
                      ? appName
                      : (appName.Length &gt; AppNameMaxLength ? appName.Substring(0, AppNameMaxLength) : appName) + ": ");
                  headerBuilder.Append(message.Message ?? "No Content");
              }
  
              var encoding = new UTF8Encoding(false);
              var bytes = encoding.GetBytes(headerBuilder.ToString());
              stream.Write(bytes, 0, bytes.Length);
          }
      }
  }
  </code></pre>
  
  <p>}</p>
  
  <p>e.g. of a message (I removed actual data and put on placeholders):</p>
  
  <p>"<em>LEEF:2.0|CompanyNameString|ProduceNameString|VersionString|int|^|
  ^cat=Test - QRADAR^sev=6^DescriptionString=^Timestamp=Apr 03 2017 14:48:02^userNameString=domain\DisplayName^accountName=samAccountName^proto=Syslog</em>"</p>
  
  <p>Any help will be much appreciated as it's been a while and I couldn't find a solution. Thanks in advance!</p>