On 8/8/2017 1:10 PM, rsyslog-users-lists.adiscon....@whyaskwhy.org wrote:
On 8/8/17 2:30 AM, Rainer Gerhards wrote:
Check what APP-NAME, PROCID and MSGID contain, which are derived from the tag.

RFC5424 tells you where these parts are to be placed in the header.

It appears that this lack of a colon is confusing pflogsumm when the daily cron job calls this script to generate a daily report of the mail activity
recorded on our central rsyslog instance.

that would indicated that pflogsumm does not properly handle RFC5424 message.


Thank you for your feedback, I appreciate you taking the time to respond.

When I enable debug logging I see that the colon is nowhere to be seen in 'programname' or 'APP-NAME' when in any of the forwarding formats (which I understand to be the norm), but is present in the syslogtag property for Traditional and Forward formats, not present for the Protocol23 forwarding format.

# RSYSLOG_TraditionalForwardFormat:
syslogtag 'postfix/qmgr[29132]:', programname: 'postfix/qmgr', APP-NAME: 'postfix/qmgr', PROCID: '29132', MSGID: '-',

# RSYSLOG_ForwardFormat:
syslogtag 'postfix/qmgr[29132]:', programname: 'postfix/qmgr', APP-NAME: 'postfix/qmgr', PROCID: '29132', MSGID: '-',

# RSYSLOG_SyslogProtocol23Format:
syslogtag 'postfix/qmgr[29132]', programname: 'postfix/qmgr', APP-NAME: 'postfix/qmgr', PROCID: '29132', MSGID: '-',

When rsyslog saves a stream of Protocol23 formatted messages to disk, I assumed that the RSYSLOG_FileFormat template would source the syslogtag property and save that entire value to disk as-is. Does something else happen instead?

If I can provide further information, please let me know.

rsyslog mailing list
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 

Reply via email to