Running RSyslog 7.6.0-1 on RHEL 6.2 x64. I have a RSyslog Windows agent forwarding logs to this RHEL based Rsyslog service.
I checked the incoming events using tcpdump from the Windows server to the Linux server and verified that incoming messages are good. But when the Linux servers forwards the messages again to another RSyslog server using omfwd/tcp, it inserts an extra space between source/host and the syslogtag. It also eats up an underscore char from FileMonitor generated syslog tags. Example, tag_audit_log ends up being "tag audit_log". I have seen this issue with 7.4 as well. I have tried using a custom template and using the default RSyslog_ForwardFormat template, seems to make no difference - the extra space appears. Any suggestions? Thanks, - Xuri _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
