[rsyslog] Unix socket with rfc5424 messages

Tomas Heinrich theinric at redhat.com
Wed Jan 9 19:37:56 CET 2013

On 11/29/2012 03:49 PM, sebastien.ponce_rsyslog at m4x.org wrote:
> Hi all,
>    following this thread of the forum :
> http://kb.monitorware.com/post22948.html#p22948 , would it be possible to
> integrate the following patch in the trunk ?
>    The only thing it does is to try the RFC3339 timestamp format on top of the
> old one for logs coming through the unix socket.


it seems I've hit a bug related to this. There's a string length 
decrement missing in ParseTIMESTAMP3339() with these symptoms:

input to imuxsock: <133>2012-12-10T16:47:28.229278+01:00 1234 5678 90ab
message in log file:           Dec 10 16:47:28 rawhide 1234 4 5678 90ab

Correcting the string length seemed to fix it and I didn't pursue why it 
generated this specific artifact. Patch is attached.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: bugfix-decrement-string-length.patch
Type: text/x-patch
Size: 887 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/rsyslog/attachments/20130109/a3e5665a/attachment.bin>

More information about the rsyslog mailing list