On Wed, 4 Mar 2015, Rainer Gerhards wrote:
2015-03-04 10:34 GMT+01:00 David Lang <[email protected]>:
On Wed, 4 Mar 2015, Rainer Gerhards wrote:
would have " 1 " between the > and Mar (I was misremembering that
the version was before the pri)
Very interesting. I am almost sure the version number is present.
that information was incorrect. That string was written in RFC3164 mode,
so
everything is fine here.
If you'd like to dig into the root of the confusion, see here:
http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html
the output from RSYSLOG_DebugFormat was
Debug line with all properties:
FROMHOST: 'vm-gentoo-x64', fromhost-ip: '127.0.0.1', HOSTNAME:
'vm-gentoo-x64', PRI: 5,
syslogtag 'vm-gentoo-x64', programname: 'vm-gentoo-x64', APP-NAME:
'vm-gentoo-x64', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Mar 3 21:27:01', STRUCTURED-DATA: '-',
msg: ' root: test'
escaped msg: ' root: test'
inputname: imuxsock rawmsg: '<5>Mar 3 21:27:01 vm-gentoo-x64 root: test'
$!:
$.:
$/:
I don't see the version in the rawmsg. what am I missing.
As I wrote in
http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html
this is a RFC*3164* message! (it is *NOT* RFC5424).
The original problem was on RFC5424, but I adapted the *test* to used
downlevel format (a side-activity to try to make the testbench work on
Gentoo) .. which also did not turn out due to other reasons. I am right now
digging down into logger and think I know where the problem is. More on
that later.
oops, I missed that the test was modified, sorry.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
