Hello Sami Kerola, you added RFC5424 support in logger in Juli 2014 [1]. Thanks for doing that! ;)
The util-linux package in v2.26 which includes your changes hit Gentoo Linux in February and uncovered a problem with imuxsock in rsyslog. While investigating the problem it turns out that the RFC5424 header produced by logger seems to be invalid. Let me quote David Lang who found the problem: > Ok, if I'm reading the log correctly, here is the line that shows the message > delivered to rsyslog > > 6630.247443933:main Q:Reg/w0 : processBATCH: next msg 0: <5>Mar 3 19:17:10 > vm-gentoo-x64 root: test > > This is showing the message being pulled from the main queue, not the raw log > arriving via uxsock, so it's possible it's already been manipulated > > according to RFC5424, the header is PRI VERSION SP TIMESTAMP SP HOSTNAME > > so if this is the raw log, this is not quite valid RFC5424, it would have " 1 > " > between the > and Mar (I was misremembering that the version was before the > pri) (From: http://thread.gmane.org/gmane.comp.sysutils.rsyslog/16531/focus=16548) It would be nice if you could join the discussion. Thanks! See also: ========= [1] http://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/misc-utils/logger.c?id=4de2e8a03859aaab2c25dc98f33409cd28de6acc -Thomas _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
