[rsyslog] Leading whitespace

[Rainer Gerhards]

This is rooted in RFC 3164. A description can be found here:

http://lists.adiscon.net/pipermail/rsyslog/2008-July/000893.html

If you want to consistently get rid of that SP, you can remove it via
the property replacer. I think this works:

$template RawMessage,"%msg:2%\n"

if not, then this ;)

$template RawMessage,"%msg:2:2048%\n"

Let us know if that cured the problem.

Rainer

On Wed, 2008-07-23 at 16:04 -0500, Mike McGrath wrote:
> Right now I'm doing live logging of my http servers to my rsyslog host.
> I've got this code on the rsyslog server:
> 
> $template RawMessage,"%msg%\n"
> $template HttpAccessTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%"
> $template HttpErrorTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%"
> 
> 
> On the http servers I've got:
> 
> CustomLog "| /usr/bin/logger -p local1.info -t join.fedoraproject.org-access.log" combined
> ErrorLog "| /usr/bin/logger -p local1.info -t join.fedoraproject.org-error.log"
> 
> 
> It works great except for one thing.  The logs have an additional
> whitespace in front of each line.  for example:
> 
>  111.111.111.11 - - [23/Jul/2008:21:01:32 +0000] "GET /static/images/fedora-logo.png HTTP/1.1" 200 5354 "http://fedoraproject.org/static/css/fedora.css" "Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.8.1.15) Gecko/20080702Fedora/2.0.0.15-1.fc8 Firefox/2.0.0.15"
> 
> Any ideas?
> 
>         -Mike
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog