can you show us a sample log?
Rsyslog does have template options that will restrict non-printable characters
(converting them to \xxx octal notation if you want)
but we would need to see your config to have any way to figure out what's going
on, and a sample of a bad log message (written with the template
RYSLOG_DebugFormat would help a huge amount)
David Lang
On Tue, 23 Mar 2021, John Chivian via rsyslog wrote:
Date: Tue, 23 Mar 2021 17:30:14 -0500
From: John Chivian via rsyslog <[email protected]>
To: rsyslog-users <[email protected]>
Cc: John Chivian <[email protected]>
Subject: Re: [rsyslog] Altering forwarded logfile names
Your use of the term “file name” is confusing. When senders deliver to rsyslog
over the network there is no exchange of files or filenames, only packets of
information. Those packets are expected to be in a format that syslog
understands such that useful information (header elements and message body) may
be parsed from them. If you as the rsyslog admin choose to use some of that
header information to compose filenames for output files, then yes you are sort
of at the mercy of the senders content (especially if the sender doesn’t follow
the syslog rules). However, there are functions in the advanced syntax that can
be used to perform the type of character replacements you’re talking about.
It is common practice to use the syslog header/rsyslog property element called
“hostname” for just such purposes. Is this what you’re talking about? You’d
have to provide your configuration for real analysis, at least the part you
perceive to be responsible for the problem.
Regards,
On Mar 23, 2021, at 12:35, Scott Slattery via rsyslog
<[email protected]> wrote:
I have a configured central log collector using rsyslog. A few of the
devices forwarding their logs are appliances that have no configuration
options other than the IP forwarding address and protocol. I cannot control
what file names are being sent.
Unfortunately, they are sending unintelligible file names with characters
that normally would be escaped. Is there any way I can control or alter the
incoming file name to normalize it to avoid these odd characters?
For example, could I establish a character map that maps the unallowed
character to something acceptable?
thanks,
*Scott Slattery*
*Sr. Systems & Cloud Architect*
*Cloud, Compute, Information & Architecture Team*
motorolasolutions.com
*O: 602.529.822*
*E*: [email protected]
--
*For more information on how and why we collect your personal
information, please visit our Privacy Policy
<https://www.motorolasolutions.com/en_us/about/privacy-policy.html?elqTrackId=8980d888905940e39a2613a7a3dcb0a7&elqaid=2786&elqat=2#privacystatement>.*
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
