> The format being sent is documented in RFC-3164, in which the only > mandatory field is PRI
No, not even PRI ;) > ---it's up the the receiving end to make sense of > the > rest of the message. It appears that in your case rsyslogd is > mis-interpreting the incoming message. Technically speaking, RFC3164 is not a standard, because it is an informational document. I have elaborated about its implications in: http://www.rsyslog.com/doc-syslog_parsing.html So if we follow your view, we simply need to accept anything as being valid, and as such we do never know which information is contained inside a message (just ask yourself the question how you know what the sender meant in this case. Message is "hostname junk" Was this intended to mean MSG = "hostname junk" or was it intended to mean hostname="hostname", MSG="junk" -- or something else? As I already wrote, we can potentially handle the "last message repeated ..." case, but only at a performance toll (we need to do a full message compare). I do not consider this acceptable as a general case. But crafting a parser module probably makes a lot of sense (thankfully we have this capability now). Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
