I need to check the code, but as "framing error" is quoted, and "pri is missing" is said, I think the case is that 2021 is right at the start of the message. That triggers octet-counted framing (message terminated after n bytes/octets, not on LF). In that mode, a SP needs to follow after the octet count, but a "-" follows.
IAW: the syslog framing is broken and indeed it is :-) You can disable octet counted framing via a module parameter, but it is always a bit dangerous to feed non-syslog data to the syslog receiver. Rainer El jue, 14 oct 2021 a las 15:35, John Chivian via rsyslog (<[email protected]>) escribió: > > Group: > > Can someone help me understand why sending this exact plain text to an > rsyslog network listener… > > 2021-10-14T08:26:31.444-00:00 > > …results in this exact error message in the rsyslog log file? > > 2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error > in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: > delimiter is not SP but has ASCII value 45. [v8.2102.0] > > > Yes, I know the priority and version are missing, but that doesn’t seem to > explain why the error is occurring. Any help is greatly appreciated. > > The input configuration is as follows… > > input(type=“imptcp” name=“ptcp-51419-in” port=“51419” > ruleset=“from_appname”) > > > Thanks in advance, > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
