Hi Xuri, Maybe others know better, but can you try RSYSLOG_DebugFormat, so see which text lands in which variable? Then you might want to make up a custom template as a workaround, for example to omit forwarding that extra space.
On Tue, Mar 4, 2014 at 3:43 AM, Xuri Nagarin <[email protected]> wrote: > Running RSyslog 7.6.0-1 on RHEL 6.2 x64. > > I have a RSyslog Windows agent forwarding logs to this RHEL based > Rsyslog service. > > I checked the incoming events using tcpdump from the Windows server to > the Linux server and verified that incoming messages are good. But > when the Linux servers forwards the messages again to another RSyslog > server using omfwd/tcp, it inserts an extra space between source/host > and the syslogtag. > > It also eats up an underscore char from FileMonitor generated syslog > tags. Example, tag_audit_log ends up being "tag audit_log". > > I have seen this issue with 7.4 as well. > > I have tried using a custom template and using the default > RSyslog_ForwardFormat template, seems to make no difference - the > extra space appears. > > Any suggestions? > > Thanks, > > - Xuri > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
