syslog server not receiving any rejected messages about openwrt HOT 2 OPEN

Digging into this more, the issue appears to be related to a a non-standard syslog message format used for the firewall messages. A non standard format is being sent as best I can tell. It is not RFC-3164 nor RFC-5424.

here is an example of one of these firewall messages. You can note how the format is NOT the same as the one received in my ticket description. This is the issue. Migrate the openwrt firewall logs to RFC5424 and this will be solved. I have no clue what "format" this is, but its not any standard. It might be possible to get there by starting with updating the date format used. I have no idea if I can control that or not. For RFC5424, the timestamp must be in RFC3339 format.

<4>Mon May 27 09:42:57 2024 kern.warn kernel: [68681.183689] reject wan out: IN=br-lan.2 OUT=wan MAC=e0:3f:49:f2:2a:d8:24:5e:be:51:6c:34:08:00 SRC=192.168.1.11 DST=1.2.3.4 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=57238 DF PROTO=TCP SPT=39966 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0

The issues are all in the header portion:

VERSION is missing (its "1 "),
DATETIME is not RFC-3339
HOSTNAME is missing
empty ("-") fields for APP-NAME, PROCID, MSGID and STRUCTURED-DATA should be placed

Here is an approx rfc5424 version of the above message:
<4>1 2024-05-27T09:42:57-04:00 OpenWrt - - - - kern.warn kernel: [68681.183689] reject wan out: IN=br-lan.2 OUT=wan MAC=e0:3f:49:f2:2a:d8:24:5e:be:51:6c:34:08:00 SRC=192.168.1.11 DST=1.2.3.4 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=57238 DF PROTO=TCP SPT=39966 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0

from openwrt.