This is rooted in RFC 3164. A description can be found here: http://lists.adiscon.net/pipermail/rsyslog/2008-July/000893.html
If you want to consistently get rid of that SP, you can remove it via the property replacer. I think this works: $template RawMessage,"%msg:2%\n" if not, then this ;) $template RawMessage,"%msg:2:2048%\n" Let us know if that cured the problem. Rainer On Wed, 2008-07-23 at 16:04 -0500, Mike McGrath wrote: > Right now I'm doing live logging of my http servers to my rsyslog host. > I've got this code on the rsyslog server: > > $template RawMessage,"%msg%\n" > $template > HttpAccessTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%" > $template > HttpErrorTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%" > > > On the http servers I've got: > > CustomLog "| /usr/bin/logger -p local1.info -t > join.fedoraproject.org-access.log" combined > ErrorLog "| /usr/bin/logger -p local1.info -t > join.fedoraproject.org-error.log" > > > It works great except for one thing. The logs have an additional > whitespace in front of each line. for example: > > 111.111.111.11 - - [23/Jul/2008:21:01:32 +0000] "GET > /static/images/fedora-logo.png HTTP/1.1" 200 5354 > "http://fedoraproject.org/static/css/fedora.css"; "Mozilla/5.0 (X11; U; Linux > x86_64; en-GB; rv:1.8.1.15) Gecko/20080702Fedora/2.0.0.15-1.fc8 > Firefox/2.0.0.15" > > Any ideas? > > -Mike > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
