I can confirm this - I also would have parsers that'd break if we did this. If we're going to start using auto trim, I'd prefer we initially start with a second token ($msgTrim or something) to ease the migration.
On Sun, Jan 24, 2016 at 2:36 PM David Lang <[email protected]> wrote: > On Sun, 24 Jan 2016, Thomas D. wrote: > > > Hi, > > > > today I converted a configuration into the modern syntax and run into > > the problem that most msg values seems to start with a space character > > which I didn't covered in my "startwith" value: > > > >> Debug line with all properties: > >> FROMHOST: 'srv42', fromhost-ip: '127.0.0.1', HOSTNAME: 'srv42', PRI: 22, > >> syslogtag 'dovecot:', programname: 'dovecot', APP-NAME: 'dovecot', > PROCID: '-', MSGID: '-', > >> TIMESTAMP: 'Jan 24 21:18:17', STRUCTURED-DATA: '-', > >> msg: ' pop3-login: Disconnected (tried to use disallowed plaintext > auth): user=<>, rip=1.2.3.4, lip=9.8.7.6' > >> escaped msg: ' pop3-login: Disconnected (tried to use disallowed > plaintext auth): user=<>, rip=1.2.3.4, lip=9.8.7.6' > >> inputname: imuxsock rawmsg: '<22>Jan 24 21:18:17 dovecot: pop3-login: > Disconnected (tried to use disallowed plaintext auth): user=<>, > rip=1.2.3.4, lip=9.8.7.6' > >> $!: > >> $.: > >> $/: > > > > Is this normal? Why don't we trim messages per default (we still have > > rawmsg for people who don't like that)? > > because the standard doesn't require such a space, and parsers written > over the > years include the space in them, so changing this will break lots of > existing > stuff. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
