2015-03-04 11:14 GMT+01:00 Rainer Gerhards <[email protected]>:
> 2015-03-04 10:38 GMT+01:00 Rainer Gerhards <[email protected]>: > >> 2015-03-04 10:34 GMT+01:00 David Lang <[email protected]>: >> >>> On Wed, 4 Mar 2015, Rainer Gerhards wrote: >>> >>> would have " 1 " between the > and Mar (I was misremembering that >>>>>>> the version was before the pri) >>>>>>> >>>>>> >>>>> Very interesting. I am almost sure the version number is present. >>>>> >>>>> >>>> that information was incorrect. That string was written in RFC3164 >>>> mode, so >>>> everything is fine here. >>>> >>>> If you'd like to dig into the root of the confusion, see here: >>>> >>>> http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html >>>> >>> >>> the output from RSYSLOG_DebugFormat was >>> >>> Debug line with all properties: >>> FROMHOST: 'vm-gentoo-x64', fromhost-ip: '127.0.0.1', HOSTNAME: >>> 'vm-gentoo-x64', PRI: 5, >>> syslogtag 'vm-gentoo-x64', programname: 'vm-gentoo-x64', APP-NAME: >>> 'vm-gentoo-x64', PROCID: '-', MSGID: '-', >>> TIMESTAMP: 'Mar 3 21:27:01', STRUCTURED-DATA: '-', >>> msg: ' root: test' >>> escaped msg: ' root: test' >>> inputname: imuxsock rawmsg: '<5>Mar 3 21:27:01 vm-gentoo-x64 root: test' >>> $!: >>> $.: >>> $/: >>> >>> >>> I don't see the version in the rawmsg. what am I missing. >>> >>> >> As I wrote in >> http://lists.adiscon.net/pipermail/rsyslog/2015-March/039850.html >> >> this is a RFC*3164* message! (it is *NOT* RFC5424). >> >> The original problem was on RFC5424, but I adapted the *test* to used >> downlevel format (a side-activity to try to make the testbench work on >> Gentoo) .. which also did not turn out due to other reasons. I am right now >> digging down into logger and think I know where the problem is. More on >> that later. >> >> > I think I know the root cause now: > > https://github.com/karelzak/util-linux/issues/157 > > Patch for logger is upcoming. > this is the patch: https://github.com/rgerhards/util-linux/commit/12664018c762c99acfae3a3abce829d7a0b55b10 I hope the util-linux community will agree that this is a bug. In any case, I'll still continue to work on imuxsock's ability to use the regular parser chain. After all arguments in these discussion threads, that seems to make sense. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
