Hi, I need to receive log since windows on tcp, but windows use log ending by <CR> (\r or \x0d),
but rsyslog log file don't create "good" file (because <CR>). example log sended by windows tcp : <open tcp>
Push: "<54>Feb 22 16:48:30 win test: aaaaaaaaaaaaa" (w/o CR/LF)
<Ack
Push: "\r" (<CR>)
<Ack
Push: "<54>Feb 22 16:48:31 win test: bbbbbbbbbbbbb" (w/o CR/LF)
<Ack
Push: "\r"
<Ack
Push: "<54>Feb 22 16:48:32 win test: ccccccccccccc" (w/o CR/LF)
<Ack
Push: "\r"
<Ack ... I have tested template but it's not work for me like this: $template templatewin,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32% %msg%\015" #$template templatewin,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32% %msg%#015" *.* /var/log/logwin;templatewin It's possible to handle "multiline" <CR> with template like? It's possible to replace "multiline" <CR> to <LF> ? or my rsyslog version are not good? Tested with rsyslog v5.8.6 on ubuntu wks v12.10_64b. Regards Rmkml _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
