On Mon, 23 Jul 2018, Stephan Seitz wrote:
On Mo, Jul 23, 2018 at 04:20:10 +0200, Rainer Gerhards wrote:
simple explanation: the colon cannot be part of a hostname (RFC
restriction). So rsyslog know that "CES:" is not a hostname and the
heuristic of the default parser so dos not assign one. In contrary.
"CES" is a perfect hostname and so it is used as such.
Should the log message start with a hostname? If this is a RFC violation I
may be able to open a support ticket.
the old RFC has never been strictly complied with, so I doubt that filing a
ticket on it will help much (if you have a config option to make it output
RFC-5424 log messages, that is more likely to be parsable)
you could use mmnormalize to write a custom parser that will parse this (and not
populate the hostname field)
David Lang
And by the way, CES is Common European Summertime (sometimes called CEST
too).
Shade and sweet water!
Stephan
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
