Description of problem:

The QRadar Integrations development team is currently working on developing an integration for auditing and infrastructure logs from Red Hat OpenShift. Having this integration has been identified as a requirement for allowing QRadar images for IBM Cloud VPC to support Fedramp.

Our developer (Vaibhav Gupta) has been following the steps outlined in https://docs.openshift.com/container-platform/4.12/logging/cluster-logging-external.html to forward the log to our QRadar boxes. We've noticed that a large number of the logs arrive truncated (from the beginning of the payloads). I've attached qradar1.1.syslog, qradar1.2.syslog and qradar1.3.syslog to show this behaviour.

We do receive some logs that are complete though. I've attached qradar_audit_logs.syslog and qradar_infr_logs.syslog to show this behaviour.

Vaibhav used WireShark and was able to confirm that the payloads were truncated before they reached QRadar. I've included syslog-traffic-4.pcap and syslog-traffic-5.pcap to show this behaviour.

We've been in email conversations with Jeff Cantrill (jcantril@redhat.com) and Vimal Kumar (vimalkum@redhat.com) about this issue and it was suggested that we open a ticket to address this. 

Vimal also joined a call with Vaibhav to verify that the log forwarder and our environment was configured properly. There were no issues found during this call.