yeah, it's a bit complicated, unfortunately. RFC3164 does not cover everything, it was merely an effort to "document what was usually seen". We tried to make things much more clear in 5424, though (but I fear it is still not perfect in regard to existing implementations).
Rainer > -----Original Message----- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of Timo Veith > Sent: Thursday, February 10, 2011 1:14 PM > To: rsyslog-users > Subject: Re: [rsyslog] filtering programname with slashes problem? > > Rainer, > > again thank you for the fast reply! Great support ! :) > > I am using $syslogtag now and it works as expected. > > Let me explain why I came to the thinking from above: > I 've read a little of the rfc which you mentioned in your first > reply, And from the section "4.1.3 MSG Part of a syslog Packet", > second paragraph I thought that the slash separates at the wrong > postition. Here is a cite from the section: > > "The MSG part has two fields known as the TAG field and the CONTENT > field. The value in the TAG field will be the name of the program or > process that generated the message. The CONTENT contains the details > of the message. .... Any non-alphanumeric character will terminate > the TAG > field and will be assumed to be the starting character of the CONTENT > field." > > So I thought the slash terminated the string name too early. > > However, as I already said, with $syslogtag it works now. > > Thanks again, > Timo > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
