[Lognorm] [rsyslog] Log normalization and the leading space

[Davor Saric]

On 04.04.2014 15:21, Rainer Gerhards wrote:
> > That's because the omfile default template inserts the space if it is not
> there.

Aha, ok.

>
>> Btw clients are CentOS 6 and Debian 7 with rsyslog v5 and central rsyslog
>> is Centos 6 with rsyslog v7 stable...
>>
>>
>>   In regard to lognorm rules, you can simply duplicate the entries with
>>> and without a space in front. It's a bit ugly, but a work-around you can
>>> use right now.
>>>
>>
>> If this is normal and is not a bug I allready have two rules and
>> templates, one for incoming logs and one for central server local apache
>> logs so I have a workaround :)
>>
>
> No, its not a bug, but it's still ugly. I always wanted to add an option to
> specify a template to be used for mmnormalize (where you could fix these
> things), but it does not play well with the message modification module
> interface, and so this change actually would be a couple of magnitudes
> larger than you'd usually expect. Given the mile-long todo list, this
> hasn't happened yet and probably will not in the forseable future :-(
>

Got it. The important part is when clients got their rsyslog clients 
officially upgraded to v7 that I don't have to change the rules and 
templates in an ongoing production environment :)

Thanks for fast response.

With regards,
Davor Saric