> I think you are forgetting about the format that the remote host is
> configured to log to disk with.
>
> If it is logging with the traditional file format, what you show as
> being in the log would be correct.
>
> remember that each instance of rsyslog has it's own templates for logs,
> you can't just change the template on the first system and expect
> systems downstream to use it.
>
> David Lang
I don't think I fully understand. I get that there can be issues between each
syslog reading in an writing out in a different format, but how does the
addition of a single colon drastically change the output? These were my two
formats:
$template myFormat,"%timereported% hostname:{%hostname%} rawmsg:{%rawmsg%}\n"
$template myFormat2,"%timereported% hostname{%hostname%} rawmsg:{%rawmsg%}\n"
And the final output when using the second is exactly what I naively expected,
but the first got garbled. When you use remote logging, is the remote rsyslog
daemon always going to parse the input based on a strict format? And if so,
what is that format, I've seen a couple mentions of different forward formats.
-Steve
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
