On Fri, 11 Sep 2009, Aaron Nichols wrote: > Hello, > Log messages are now being delivered correctly after raising the > messagesize value - now I seem to be having some issue with parsing. I am > trying to log only the %msg% portion of the log message however the > beginning of that message seems to be removed. Below are the two templates I > used to log in both the rawmsg and then the value of %msg% so you can see > what is being removed. I cannot post the entire %msg% value, but the two are > the same with the exception of the beginning value. I just need to be able > to log the message portion without the timestamp which is being delivered > from the client. > > Thinking this may have been fixed with some of the parsing problems I have > updated to the latest 4.x stable release - this problem has been observed on > 3.22.1 & 4.4.1. I am currently running against 4.4.1. > > Two templates: > $template ServerXML, "%timestamp% || %hostname% || %msg%\n" > $template ServerXMLraw, "%rawmsg%\n" > > Using the first template the message looks like this: > Sep 11 21:15:01 || localhost || time="1252703701.94" userId=... (remainder > of message removed for brevity, but it is intact in the logs) > > Using the second template the raw message looks like this: > <142>Sep 11 21:15:01 localhost <protocolLogRecord time="1252703701.94" > userId= > > I'm trying to understand why the value "<protocolLogRecord" is being removed > from %msg%.
because it's being put in %syslogtag% as the program name. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
