[rsyslog] Syslogtags with whitespaces misparsed?

[Rainer Gerhards]

Just let me say that I try really hard to make rsyslog guess right for even
the most malformed mesage format. The real issue is that there have been no
standards for many years, and so there is a lot of incompatible formats out
there.

In this case, however, I do really not see how I could handle that
intelligently within the parser (except if we create per-host custom parsers,
something on my list but not even begun to work on).

I guess that the gconf folks will not want to change their format, because
that, too could potentially also break a lot of things (log parsers!).

A solution within rsyslog configuration could be to check the hostname and
apply some special template (which then utilizes the property replacer to
extract the "right" information) when the hostname is "gconf". That, of
course, means that no host ever must be named "gconf", but I think you can
enforce that ;)

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com 
> [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Luis 
> Fernando Muñoz Mejías
> Sent: Thursday, July 16, 2009 3:49 PM
> To: rsyslog at lists.adiscon.com
> Subject: Re: [rsyslog] Syslogtags with whitespaces misparsed?
> 
> Rainer,
> 
> El Jueves, 16 de Julio de 2009 15:31, Rainer Gerhards escribió:
> > Just a quick note: there is no such thing as a whitespace 
> inside a syslog
> > tag (read rfc3164, 5424).
> 
> Thanks a lot, I'll tell people around here. Now I know who I must piss
> off. :)
> 
> > The message is severely malformed and i do not see any way 
> how rsyslog
> > could guess the intention of the sender correctly
> 
> Indeed, rsyslog is not responsible for misbehaving senders, I just
> needed to clarify the source of my problem.
> 
> Cheers.
> -- 
> Luis Fernando Muñoz Mejías
> Luis.Fernando.Munoz.Mejias at cern.ch
> 
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>