On Wed, 4 Mar 2015, Rainer Gerhards wrote:
would have " 1 " between the > and Mar (I was misremembering that
the version was before the pri)
Very interesting. I am almost sure the version number is present.
that information was incorrect. That string was written in RFC3164 mode, so
everything is fine here.
If you'd like to dig into the root of the confusion, see here:
http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html
the output from RSYSLOG_DebugFormat was
Debug line with all properties:
FROMHOST: 'vm-gentoo-x64', fromhost-ip: '127.0.0.1', HOSTNAME: 'vm-gentoo-x64',
PRI: 5,
syslogtag 'vm-gentoo-x64', programname: 'vm-gentoo-x64', APP-NAME:
'vm-gentoo-x64', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Mar 3 21:27:01', STRUCTURED-DATA: '-',
msg: ' root: test'
escaped msg: ' root: test'
inputname: imuxsock rawmsg: '<5>Mar 3 21:27:01 vm-gentoo-x64 root: test'
$!:
$.:
$/:
I don't see the version in the rawmsg. what am I missing.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
