2016-01-25 5:52 GMT+01:00 Chris Schafer <[email protected]>: > I can confirm this - I also would have parsers that'd break if we did this. > If we're going to start using auto trim, I'd prefer we initially start with > a second token ($msgTrim or something) to ease the migration. > > I have no intent to do so. The space stems from RFC3164, and so it is as it is supposed to be. We could add a trim() function, however...
Rainer > On Sun, Jan 24, 2016 at 2:36 PM David Lang <[email protected]> wrote: > > > On Sun, 24 Jan 2016, Thomas D. wrote: > > > > > Hi, > > > > > > today I converted a configuration into the modern syntax and run into > > > the problem that most msg values seems to start with a space character > > > which I didn't covered in my "startwith" value: > > > > > >> Debug line with all properties: > > >> FROMHOST: 'srv42', fromhost-ip: '127.0.0.1', HOSTNAME: 'srv42', PRI: > 22, > > >> syslogtag 'dovecot:', programname: 'dovecot', APP-NAME: 'dovecot', > > PROCID: '-', MSGID: '-', > > >> TIMESTAMP: 'Jan 24 21:18:17', STRUCTURED-DATA: '-', > > >> msg: ' pop3-login: Disconnected (tried to use disallowed plaintext > > auth): user=<>, rip=1.2.3.4, lip=9.8.7.6' > > >> escaped msg: ' pop3-login: Disconnected (tried to use disallowed > > plaintext auth): user=<>, rip=1.2.3.4, lip=9.8.7.6' > > >> inputname: imuxsock rawmsg: '<22>Jan 24 21:18:17 dovecot: pop3-login: > > Disconnected (tried to use disallowed plaintext auth): user=<>, > > rip=1.2.3.4, lip=9.8.7.6' > > >> $!: > > >> $.: > > >> $/: > > > > > > Is this normal? Why don't we trim messages per default (we still have > > > rawmsg for people who don't like that)? > > > > because the standard doesn't require such a space, and parsers written > > over the > > years include the space in them, so changing this will break lots of > > existing > > stuff. > > > > David Lang > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
