what version of rsyslog are you running? it seems odd that it's parsing the
programname incorrectly (as '1')
everything should just work with the new format.
David Lang
On Tue, 22 Jun 2021, Ansgar Puester via rsyslog wrote:
Date: Tue, 22 Jun 2021 14:01:31 +0200
From: Ansgar Puester via rsyslog <[email protected]>
To: rsyslog-users <[email protected]>
Cc: Ansgar Puester <[email protected]>
Subject: [rsyslog] Problem with tool logger from sysklogd v2.2.3
Hello,
up to now we use the tool logger from util-linux 2.34
We would like to switch to logger from sysklogd v2.2.3
To test the new logger i used
logger -t 'logger' -i -p local0.info "Testmessage"
logger from util-linux 2.34 produces the message
Template="RSYSLOG_TraditionalFileFormat"
Jun 22 13:29:37 logserv.fritz.box logger[5849]: Testmessage
Template="RSYSLOG_DebugFormat"
Debug line with all properties:
FROMHOST: 'logserv.fritz.box', fromhost-ip: '127.0.0.1', HOSTNAME:
'logserv.fritz.box', PRI: 134,
syslogtag 'logger[5849]:', programname: 'logger', APP-NAME: 'logger', PROCID:
'5849', MSGID: '-',
TIMESTAMP: 'Jun 22 13:29:37', STRUCTURED-DATA: '-',
msg: ' Testmessage'
escaped msg: ' Testmessage'
inputname: imuxsock rawmsg: '<134>Jun 22 13:29:37 logger[5849]: Testmessage'
$!:{ "data": { "modprogramname": "logger" } }
$.:
$/:
logger from sysklogd v2.2.3 produces the message
Template="RSYSLOG_DebugFormat"
Jun 22 13:29:51 logserv.fritz.box 1 2021-06-22T13:29:51.413381+02:00 logserv
logger 5850 - - Testmessage
Template="RSYSLOG_DebugFormat"
Debug line with all properties:
FROMHOST: 'logserv.fritz.box', fromhost-ip: '127.0.0.1', HOSTNAME:
'logserv.fritz.box', PRI: 134,
syslogtag '1', programname: '1', APP-NAME: '1', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Jun 22 13:29:51', STRUCTURED-DATA: '-',
msg: ' 2021-06-22T13:29:51.413381+02:00 logserv logger 5850 - - Testmessage '
escaped msg: ' 2021-06-22T13:29:51.413381+02:00 logserv logger 5850 - -
Testmessage '
inputname: imuxsock rawmsg: '<134>1 2021-06-22T13:29:51.413381+02:00 logserv
logger 5850 - - Testmessage '
$!:{ "data": { "modprogramname": "1" } }
$.:
$/:
Is there a way to convert this new, unwanted message to the "old"
message format?
I did not find a parameter to tell logger from sysklogd v2.2.3
to produce the "old" message format.
Does anybody have a solution?
Thanks in advance
Ansgar
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
