If I remember correctly, underscore is not a valid character in a syslog tag, so the parser terminates the tag here. The debug format will show.
Sent from phone, thus brief. Am 04.03.2014 14:07 schrieb "Radu Gheorghe" <[email protected]>: > Hi Xuri, > > Maybe others know better, but can you try RSYSLOG_DebugFormat, so see > which text lands in which variable? Then you might want to make up a > custom template as a workaround, for example to omit forwarding that > extra space. > > On Tue, Mar 4, 2014 at 3:43 AM, Xuri Nagarin <[email protected]> wrote: > > Running RSyslog 7.6.0-1 on RHEL 6.2 x64. > > > > I have a RSyslog Windows agent forwarding logs to this RHEL based > > Rsyslog service. > > > > I checked the incoming events using tcpdump from the Windows server to > > the Linux server and verified that incoming messages are good. But > > when the Linux servers forwards the messages again to another RSyslog > > server using omfwd/tcp, it inserts an extra space between source/host > > and the syslogtag. > > > > It also eats up an underscore char from FileMonitor generated syslog > > tags. Example, tag_audit_log ends up being "tag audit_log". > > > > I have seen this issue with 7.4 as well. > > > > I have tried using a custom template and using the default > > RSyslog_ForwardFormat template, seems to make no difference - the > > extra space appears. > > > > Any suggestions? > > > > Thanks, > > > > - Xuri > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > > > > -- > Performance Monitoring * Log Analytics * Search Analytics > Solr & Elasticsearch Support * http://sematext.com/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
