[rsyslog] How can I use high precision forwarding format, but still preserve the Postfix process name in forwarded messages?

2017-08-05 Thread deoren
I've recently converted all of our nodes from forwarding messages from the default forwarding format to using the 'RSYSLOG_SyslogProtocol23Format' format. I only did light research beforehand (so I can only blame myself), but when our relay nodes log in either 'RSYSLOG_TraditionalFileFormat' o

Re: [rsyslog] How can I use high precision forwarding format, but still preserve the Postfix process name in forwarded messages?

2017-08-05 Thread David Lang
on the receiver, write a log with the format rawmsg or use the RSYSLOG_DebugFormat and look at the rawmsg line there. Let's see exactly what is being sent to see if the data is being lost at transmit or on reception. Personally, I have my senders reformat the data so that the body of the messag

Re: [rsyslog] How can I use high precision forwarding format, but still preserve the Postfix process name in forwarded messages?

2017-08-05 Thread deoren
On 8/5/17 10:59 PM, deoren wrote: I've recently converted all of our nodes from forwarding messages from the default forwarding format to using the 'RSYSLOG_SyslogProtocol23Format' format. I only did light research beforehand (so I can only blame myself), but when our relay nodes log in eithe

Re: [rsyslog] How can I use high precision forwarding format, but still preserve the Postfix process name in forwarded messages?

2017-08-05 Thread deoren
On 8/5/17 11:28 PM, David Lang wrote: on the receiver, write a log with the format rawmsg or use the RSYSLOG_DebugFormat and look at the rawmsg line there. Let's see exactly what is being sent to see if the data is being lost at transmit or on reception. Personally, I have my senders reformat

Re: [rsyslog] How can I use high precision forwarding format, but still preserve the Postfix process name in forwarded messages?

2017-08-05 Thread David Lang
I'll post something in more detail later. On Sat, 5 Aug 2017, deoren wrote: That said, thank you for the tips. I know I'm eventually going to have to look at using JSON since most of the popular tool chains I'm researching seem to prefer it (e.g., Elastic Stack, Graylog), so I'm definitely int