RFC-5424 also adds a version[1] code, which is "1" for RFC-5424 and may
be incremented in future versions of the SysLog spec. This should have
been included in my previous code sample. It involves amending the
pattern line like this:
logpattern << "1 %d{%Y-%m-%dT%H:%M:%SZ} "
<< _hostname << " " << progname << " " << getpid()
<< " - - %m";
The log4cplus project (also packaged[2]) states in the API docs that it
supports 5424 natively[3]
The fully revised sample:
log4cpp::Appender *appender1 =
new log4cpp::RemoteSyslogAppender("default", argv[0], "log-host");
// Configure pattern for log messages
bool useRfc5424 = true;
std::stringstream logpattern;
const char* progname = rindex(argv[0], '/');
if(progname == 0) {
progname = argv[0];
} else {
progname++;
}
if(useRfc5424) {
// create a Syslog RFC-5424 compliant layout for log strings
char _hostname[512];
if(gethostname(_hostname, 510) < 0) {
strcpy(_hostname, "unknown-hostname");
}
logpattern << "1 %d{%Y-%m-%dT%H:%M:%SZ} "
<< _hostname << " " << progname << " " << getpid()
<< " - - %m";
} else {
// create a Syslog RFC-3164 compliant layout for log strings
logpattern << progname << '[' << getpid() << "]: %m";
}
log4cpp::PatternLayout *pl = new log4cpp::PatternLayout();
pl->setConversionPattern(logpattern.str());
appender1->setLayout(pl);
1. https://tools.ietf.org/html/rfc5424#section-6.2.2
2. https://packages.qa.debian.org/l/log4cplus.html
3.
http://log4cplus.sourceforge.net/docs/html/classlog4cplus_1_1SysLogAppender.html
