Hello,
Log messages are now being delivered correctly after raising the
messagesize value - now I seem to be having some issue with parsing. I am
trying to log only the %msg% portion of the log message however the
beginning of that message seems to be removed. Below are the two templates I
used to log in both the rawmsg and then the value of %msg% so you can see
what is being removed. I cannot post the entire %msg% value, but the two are
the same with the exception of the beginning value. I just need to be able
to log the message portion without the timestamp which is being delivered
from the client.
Thinking this may have been fixed with some of the parsing problems I have
updated to the latest 4.x stable release - this problem has been observed on
3.22.1 & 4.4.1. I am currently running against 4.4.1.
Two templates:
$template ServerXML, "%timestamp% || %hostname% || %msg%\n"
$template ServerXMLraw, "%rawmsg%\n"
Using the first template the message looks like this:
Sep 11 21:15:01 || localhost || time="1252703701.94" userId=... (remainder
of message removed for brevity, but it is intact in the logs)
Using the second template the raw message looks like this:
<142>Sep 11 21:15:01 localhost <protocolLogRecord time="1252703701.94"
userId=
I'm trying to understand why the value "<protocolLogRecord" is being removed
from %msg%.
Thanks,
Aaron
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
