On Tue, 2009-01-20 at 11:05 +0800, Patrick Shen wrote: > >> But in above example: > >> Word 'Caused' is between '<171>' and 'by ...'. So the HOSTNAME is > >> accidentally set to 'Caused'. > >> > >> I'm wondering if it's a coincidence that if spaces exist between <PRI> and > >> messages in rawmsg and hostname is not provided, > >> then HOSTNAME will be set correctly? > > > > that's probably the case with current code, but I don't guarantee that > > will stay. Again: invalid format => unpredictable results on all header > > fields > > OK, now I see the malformed format messages will cause unpredictable results > in rsyslog. > That's quite helpful. > > >> > >> And I thought I could use 'FROMHOST' property, but I have another scenario. > >> > >> ###################################################################################### > >> Debug line with all properties: > >> FROMHOST: '172.20.101.6', HOSTNAME: 'icarus', PRI: 174, > >> syslogtag 'httpd8330.sms:', programname: 'httpd8330.sms', APP-NAME: > >> 'httpd8330.sms', PROCID: '-', MSGID: '-', FACILITY-TEXT: 'local5' > >> TIMESTAMP: 'Jan 19 15:14:50', STRUCTURED-DATA: '-', > >> msg: ' xxx.xxx.internal - - [19/Jan/2009:15:14:50 +0100] "GET > >> /itransport/mbg/mbg/io/mbg?provider=TMOBILE_XTC_3ABO_LIVE&request-type=chargeSubscription&critialdata&originator-id=PGW_6686//S0002865748&service-type=web&payment-type=subscr&amount=299&subscription-amount=299&item-amount=299&msisdn=00491704127650&subscription-id=1662126457&subscription-type=2&reply-path=http://pgw:8330/sms/pgw/intern/ReportReception&sms-text=Dein+Abo+wurde+mit+2.99+Euro+gebucht. > >> HTTP/1.1" 200 87#012' > >> rawmsg: '<174>2009-01-19T15:14:50.923441+01:00 icarus httpd8330.sms: > >> xxx.xxx.internal - - [19/Jan/2009:15:14:50 +0100] "GET > >> /itransport/mbg/mbg/io/mbg?provider=TMOBILE_XTC_3ABO_LIVE&request-type=chargeSubscription&critialdata&originator-id=PGW_6686//S0002865748&service-type=web&payment-type=subscr&amount=299&subscription-amount=299&item-amount=299&msisdn=00491704127650&subscription-id=1662126457&subscription-type=2&reply-path=http://pgw:8330/sms/pgw/intern/ReportReception&sms-text=Dein+Abo+wurde+mit+2.99+Euro+gebucht. > >> HTTP/1.1" 200 87#012' > >> ###################################################################################### > >> > > that's a correctly formatted message > > > >> You could see in HOSTNAME field, it's correct set to 'icarus'. But in > >> FROMHOST field is ip address. > >> And I do have reverse zone for that ip in dns setting. Any ideas? > > > > To get the name, you indeed need to enable remote lookups. One solution > > would be to permit different settings for different remote hosts, but > > that would be a feature request. Would make sense, but I am currently > > rather busy. If you add it to the bugzilla http://bugzilla.adiscon.com > > I'll see that I implement it when nothing of higher priority is in front > > of it. > > I've filed a bugzilla report [1] for your information. Anyway, one more > question, if I use rsyslog at > the client side, will it avoid malformed/invalid format message sending out?
I have tweaked the feature request a bit so that it matches the actual request ;) As far as rsyslog on the client side is concerned, you need to do nothing. If you use the default templates, it emits correctly formatted messages. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
