Dear rsyslogd users, I have a semicolon seperated msg but the first field in the submitted string has a space in it.
Here is the %rawmsg% "<158>Dec 21 22:35:21 x-wing.datacymru.net 2010-12-21 22:35:21;2010-12-21 22:35:21+0000;null;null;35667;127.0.0.1;USER_ACCESS;USER_LOGGED_IN;User: [email protected] Logged in" And here is the resulting %msg% " 22:35:21;2010-12-21 22:35:21+0000;null;null;35667;127.0.0.1;USER_ACCESS;USER_LOGGED_IN;User: [email protected] Logged in" (The double quotes aren't part of the resulting text, I've just put it there to indicate the leading <space> in the %msg%) As you can see the first field has been stripped of it's 'yyyy-MM-dd' component. This makes the DB insert fail
pgsql, DBError(silent): db error (0): ERROR: invalid input syntax for type timestamp: " 22:49:38" at character 136
I've found that the missing text makes it's way to the %app-name% and %syslogtag% properties I have a workaround, by using %syslogtag%%msg:F,59:1% to provide the two parts as required. I'd like to not use a workaround if possible. is there a command the defines how the message is pulled out from the raw.? can I encapsulate my semicolon-delimited string any better to avoid this behaviour? Many thanks Rob -- Rob Shepherd BEng PhD - Director / Senior Engineer - DataCymru Ltd _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
