[rsyslog] Wrongly formatted messages from kernel/netconsole

[Dag Wieers]

Hi,

We have been looking at why we don't see messages from netconsole ending 
up in our logfiles. netconsole is a kernel module that sends information 
of kernel panics to a syslog server. The documentation indicates it should 
work with syslog as an endpoint but that is not true with rsyslog, 
apparently :)

 	https://bugzilla.redhat.com/show_bug.cgi?id=432160

Also, I have noticed that our central rsyslog-server (more than 400 
systems log to it) have directories with names like: Detected/, exiting/, 
ext3_abort/, EXT3-fs/, journal/, last/, martian/, program/, Remounting/, 
Restarting/, ... So it is obvious that something is not working as 
expected coming from the kernel.

>From information I found online, a message formatted like:

 	<4>Testing

through netcat should work for testing the syslog connectivity, but it is 
clear that rsyslog only accepts:

 	<4>Oct  7 12:34:56 hostname Testing

but of course I cannot influence our production kernels to do the right 
thing. What can I do to have rsyslog accept the "wrong" thing ? :)

Advice is appreciated :)
-- 
--   dag wieers,  dag at wieers.com,  http://dag.wieers.com/   --
[Any errors in spelling, tact or fact are transmission errors]