Hi, We have a remote syslog server that is receiving logs in the following format from an F5 load balancer:
<13>2014-03-19T11:24:13.796347+11:00 lb1-266-1-res-v3893.unimelb.net.au glance-registry.rc.nectar.org.au:9191 172.26.71.41 115.146.84.105 - - [19/Mar/2014:11:23:59 +1100] "GET /images/034f7d4d-4ec2-424d-bbff-a4b8809dc01d HTTP/1.1" 200 0 "-" "-" "-" A packet trace confirms this is the format it is receiving: 1.688922 172.26.8.101 -> 172.26.8.238 RSH 315 <13>2014-03-19T11:24:13.796347+11:00 lb1-266-1-res-v3893.unimelb.net.au glance-registry.rc.nectar.org.au:9191 172.26.71.41 115.146.84.105 - - [19/Mar/2014:11:23:59 +1100] "GET /images/034f7d4d-4ec2-424d-bbff-a4b8809dc01d HTTP/1.1" 200 0 "-" "-" "-"\n Output to logstash also receives this same format. However, output to file seems to be adding a space between the glance-registry.rc.nectar.org.au: and the 9191: 2014-03-19T11:24:13.796347+11:00 lb1-266-1-res-v3893.unimelb.net.au glance-registry.rc.nectar.org.au: 9191 172.26.71.41 115.146.84.105 - - [19/Mar/2014:11:23:59 +1100] "GET /images/034f7d4d-4ec2-424d-bbff-a4b8809dc01d HTTP/1.1" 200 0 "-" "-" "-" It does this for all host:port combinations. Any idea what might be going on there? Regards, Marcus. -- Marcus Furlong _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
