Rainer, again thank you for the fast reply! Great support ! :)
I am using $syslogtag now and it works as expected. Let me explain why I came to the thinking from above: I 've read a little of the rfc which you mentioned in your first reply, And from the section "4.1.3 MSG Part of a syslog Packet", second paragraph I thought that the slash separates at the wrong postition. Here is a cite from the section: "The MSG part has two fields known as the TAG field and the CONTENT field. The value in the TAG field will be the name of the program or process that generated the message. The CONTENT contains the details of the message. .... Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field." So I thought the slash terminated the string name too early. However, as I already said, with $syslogtag it works now. Thanks again, Timo _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
