On Sun, 8 Mar 2015, Thomas D. wrote:
Hi,
thank you David and Rainer. I think we found some test cases.
But I still have some questiones ;)
I installed util-linux from source, i.e. commit c958032a6.
Most bugfixes from Rainer should be included.
I run
# logger --stderr --rfc3164 --tag foo --socket /dev/log "Testmsg in RFC3164"
<13>Mar 8 23:49:13 vm-gentoo-x64 foo: Testmsg in RFC3164
and rsyslog logged
Debug line with all properties:
FROMHOST: 'vm-gentoo-x64', fromhost-ip: '127.0.0.1', HOSTNAME: 'vm-gentoo-x64',
PRI: 13,
syslogtag 'vm-gentoo-x64', programname: 'vm-gentoo-x64', APP-NAME:
'vm-gentoo-x64', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Mar 8 23:49:13', STRUCTURED-DATA: '-',
msg: ' foo: Testmsg in RFC3164'
escaped msg: ' foo: Testmsg in RFC3164'
inputname: imuxsock rawmsg: '<13>Mar 8 23:49:13 vm-gentoo-x64 foo: Testmsg in
RFC3164'
$!:
$.:
$/:
I am wondering how rsyslog is handling tag "foo". I would have expected
"syslogtag 'foo'" (see
http://www.rsyslog.com/doc/property_replacer.html, "syslogtag TAG from
the message").
Am I wrong? Bug in rsyslog-8.8.0?
I believe that when you write the log to the socket, you aren't expected to put
the hostname in it, since it's local rsyslog uses what it knows the hostname to
be. You can't tell this with your test because you put the real hostname in that
spot.
can you try an older version of util-linux?
here's what I get on my ubuntu machine
Debug line with all properties:
FROMHOST: 'dlang-laptop', fromhost-ip: '127.0.0.1', HOSTNAME: 'dlang-laptop',
PRI: 13,
syslogtag 'dlang:', programname: 'dlang', APP-NAME: 'dlang', PROCID: '-', MSGID:
'-',
TIMESTAMP: 'Mar 8 16:03:04', STRUCTURED-DATA: '-',
msg: ' testtest @[_PID=22257 _UID=0 _GID=0 _COMM=logger _CMDLINE=""]'
escaped msg: ' testtest @[_PID=22257 _UID=0 _GID=0 _COMM=logger _CMDLINE=""]'
inputname: imuxsock rawmsg: '<13>Mar 8 16:03:04 dlang: testtest @[_PID=22257
_UID=0 _GID=0 _COMM=logger _CMDLINE=""]'
$!:
$.:
$/:
$ cat /etc/rsyslog.conf
module(load="impstats" interval="10" resetCounters="on" format="legacy"
ruleset="high_p")
module(load="imklog")
module(load="imuxsock" SysSock.RateLimit.Interval="0" SysSock.Annotate="on")
action(type="omfile" File="/var/log/messages")
action(name="send_remote" type="omfwd" Target="192.168.2.11" Port="514"
Protocol="tcp" queue.type="FixedArray" )
ruleset(name="high_p" queue.type="FixedArray"){
action(type="omfile" File="/var/log/pstats")
action(name="send_HP" type="omfwd" Target="192.168.2.11" Port="514"
Protocol="tcp" queue.type="FixedArray" )
}
if $rawmsg contains "testtest" then /var/log/testtest;RSYSLOG_DebugFormat
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
