2015-03-04 10:34 GMT+01:00 David Lang <[email protected]>: > On Wed, 4 Mar 2015, Rainer Gerhards wrote: > > would have " 1 " between the > and Mar (I was misremembering that >>>>> the version was before the pri) >>>>> >>>> >>> Very interesting. I am almost sure the version number is present. >>> >>> >> that information was incorrect. That string was written in RFC3164 mode, >> so >> everything is fine here. >> >> If you'd like to dig into the root of the confusion, see here: >> >> http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html >> > > the output from RSYSLOG_DebugFormat was > > Debug line with all properties: > FROMHOST: 'vm-gentoo-x64', fromhost-ip: '127.0.0.1', HOSTNAME: > 'vm-gentoo-x64', PRI: 5, > syslogtag 'vm-gentoo-x64', programname: 'vm-gentoo-x64', APP-NAME: > 'vm-gentoo-x64', PROCID: '-', MSGID: '-', > TIMESTAMP: 'Mar 3 21:27:01', STRUCTURED-DATA: '-', > msg: ' root: test' > escaped msg: ' root: test' > inputname: imuxsock rawmsg: '<5>Mar 3 21:27:01 vm-gentoo-x64 root: test' > $!: > $.: > $/: > > > I don't see the version in the rawmsg. what am I missing. > > As I wrote in http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html
this is a RFC*3164* message! (it is *NOT* RFC5424). The original problem was on RFC5424, but I adapted the *test* to used downlevel format (a side-activity to try to make the testbench work on Gentoo) .. which also did not turn out due to other reasons. I am right now digging down into logger and think I know where the problem is. More on that later. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
