[rporter92]

Issue

audit-log --target syslog and --target syslog-port emit syslog lines with an empty HOSTNAME field, producing two consecutive spaces between the timestamp and APP-NAME:

<110>1 2026-09-02T17:17:32Z Keeper - 24983911115 [Keeper@Commander ...]

RFC 5424 §6.2.4 defines HOSTNAME as either the NILVALUE (-) or 1–255 printable US-ASCII characters (codes 33–126). An empty value satisfies neither form, and strict RFC 5424 receivers reject the message entirely.

Root cause

AuditLogSyslogBaseExport.convert_event() checked only whether the ip_address key was present, not whether its value was usable:

ip = "-"
if 'ip_address' in event:
    ip = event['ip_address']

When the backend returns ip_address as an empty string (""), Commander passed it straight into the syslog header, producing an invalid message. The same path also allowed None, whitespace-only strings, and non-printable characters to reach the HOSTNAME field.

Change

convert_event() now normalises HOSTNAME before formatting the header:

# RFC 5424 section 6: HOSTNAME = NILVALUE / 1*255PRINTUSASCII (codes 33-126).
# Fall back to NILVALUE "-" for missing, null, empty, whitespace or non-printable values.
ip = str(event.get('ip_address') or '').strip()
if not ip or not all(33 <= ord(ch) <= 126 for ch in ip):
    ip = '-'
ip = ip[:255]

• Missing key, None, empty string, and whitespace-only values all fall back to -.
• Any value containing a character outside codes 33–126 (non-printable or non-ASCII) also falls back to -.
• Values are capped at 255 characters per the RFC.
• Valid IP addresses (IPv4 and IPv6) pass through unchanged.

Testing

Reproduction

1. Login to Keeper Vault using the Browser Extension
2. Run audit-log command via Commander with target set as syslog
3. See Browser Extension login event recorded with IP set as two spaces (E.G. -- "07Z Keeper"
4. Applied fix, ran same commands
5. Same Browser Extension login event now recorded as expected (E.G. -- 07Z - Keeper)

Live validation

Reproduced the bug by generating a device_approved event for a Web Vault login where the backend returned ip_address: "". Exported with the unpatched build and confirmed two spaces in the HOSTNAME field. Re-exported with the patched build — the double-space pattern was gone and the event showed - Keeper with a single NILVALUE hyphen. Events carrying a real IP continued to show that IP in HOSTNAME.

Unit tests (unit-tests/test_audit_log_syslog.py)

21 tests covering both AuditLogSyslogFileExport and AuditLogSyslogPortExport:

• test_hostname_is_rfc5424_valid (18 cases, parametrised across both exporters) — verifies that None, "", whitespace, tab, non-ASCII, and null-byte values all produce - in HOSTNAME, that leading/trailing whitespace is stripped from otherwise valid values, and that valid IPv4 and IPv6 addresses pass through unchanged. Each case also asserts APP-NAME is Keeper and that no double-space appears in the header.
• test_missing_key_still_uses_nilvalue — verifies that an event with no ip_address key at all still produces a correctly formatted header starting with - Keeper.
• test_hostname_truncated_to_255 — verifies that a 300-character value is truncated to exactly 255 characters.
• test_ip_address_not_duplicated_in_structured_data — verifies that an empty ip_address value does not appear as ip_address= anywhere in the structured-data block.

Running the tests against the original code yields 15 failed, 6 passed (the 6 passing are the valid-IP cases, which the fix must not change). With the fix applied: 21 passed.

The full existing unit suite (unit-tests/) continues to pass with no new failures (2423 passed, 59 skipped).