2015-03-04 10:38 GMT+01:00 Rainer Gerhards <[email protected]>:
> 2015-03-04 10:34 GMT+01:00 David Lang <[email protected]>: > >> On Wed, 4 Mar 2015, Rainer Gerhards wrote: >> >> would have " 1 " between the > and Mar (I was misremembering that >>>>>> the version was before the pri) >>>>>> >>>>> >>>> Very interesting. I am almost sure the version number is present. >>>> >>>> >>> that information was incorrect. That string was written in RFC3164 mode, >>> so >>> everything is fine here. >>> >>> If you'd like to dig into the root of the confusion, see here: >>> >>> http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html >>> >> >> the output from RSYSLOG_DebugFormat was >> >> Debug line with all properties: >> FROMHOST: 'vm-gentoo-x64', fromhost-ip: '127.0.0.1', HOSTNAME: >> 'vm-gentoo-x64', PRI: 5, >> syslogtag 'vm-gentoo-x64', programname: 'vm-gentoo-x64', APP-NAME: >> 'vm-gentoo-x64', PROCID: '-', MSGID: '-', >> TIMESTAMP: 'Mar 3 21:27:01', STRUCTURED-DATA: '-', >> msg: ' root: test' >> escaped msg: ' root: test' >> inputname: imuxsock rawmsg: '<5>Mar 3 21:27:01 vm-gentoo-x64 root: test' >> $!: >> $.: >> $/: >> >> >> I don't see the version in the rawmsg. what am I missing. >> >> > As I wrote in > http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html > > this is a RFC*3164* message! (it is *NOT* RFC5424). > > The original problem was on RFC5424, but I adapted the *test* to used > downlevel format (a side-activity to try to make the testbench work on > Gentoo) .. which also did not turn out due to other reasons. I am right now > digging down into logger and think I know where the problem is. More on > that later. > > I think I know the root cause now: https://github.com/karelzak/util-linux/issues/157 Patch for logger is upcoming. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
