[rsyslog-notify] Forum Thread: Re: Unix socket with rfc5424 messages - (Mode 'reply')

[noreply at adiscon.com]

User: ldo2000 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24543#p24543

Message: 
----------
Hi,
I'm also resurrecting this thread as I'm running into the same problem. I'm
developing an application that needs to log RFC-5424 format messages to
rsyslog. When I started testing the app, I found that when the message is
sent using the Unix domain socket most of the fields are messed up. It
works though if I send the same message through UDP to 127.0.0.1. I then
found this thread. This thread mentions a code change to fix the issue.
Originally I was using rsyslog v. 5.8.10, so I upgraded to the latest
stable version (7.6.3) thinking that would fix it, but I still have the
same problem. 

I have to use RFC-5424 format. Since there is going to be a lot of logging
through this application, I would prefer to use the most efficient
interface, and Unix sockets seems the best way. Another requirement 

The application actually takes some proprietary alarms from other external
elements and creates corresponding syslog records. Is there a fix available
and I still don't have the correct version, or is there some other reason
this hasn't been fixed? I searched through the bug list and I can't find it
listed as bug either. I hate to have to use a full socket interface to work
around this because of the extra overhead. I've pasted sample debug out
below showing the problem.

Thanks,
Lindsey

// via unix sockets
Debug line with all properties:
FROMHOST: 'UbuntuDT-LDO', fromhost-ip: '127.0.0.1', HOSTNAME:
'UbuntuDT-LDO', PRI: 165,
syslogtag '1', programname: '1', APP-NAME: '1', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Apr 16 11:09:13', STRUCTURED-DATA: '-',
msg: ' 2014-12-31T07:35:13-06:00 HostName1 AppName1 12345 98765 - T17 Pri =
165 Date of 12/31/2014 02:59'
escaped msg: ' 2014-12-31T07:35:13-06:00 HostName1 AppName1 12345 98765 -
T17 Pri = 165 Date of 12/31/2014 02:59'
inputname: imuxsock rawmsg: '<165>1 2014-12-31T07:35:13-06:00 HostName1
AppName1 12345 98765 - T17 Pri = 165 Date of 12/31/2014 02:59'
$!:
$.:
$/:

// via udp
Debug line with all properties:
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'HostName1',
PRI: 165,
syslogtag 'AppName1[12345]', programname: 'AppName1', APP-NAME: 'AppName1',
PROCID: '12345', MSGID: '98765',
TIMESTAMP: 'Dec 31 07:35:04', STRUCTURED-DATA: '-',
msg: 'T17 Pri = 165 Date of 12/31/2014 02:59'
escaped msg: 'T17 Pri = 165 Date of 12/31/2014 02:59'
inputname: imudp rawmsg: '<165>1 2014-12-31T07:35:04-06:00 HostName1
AppName1 12345 98765 - T17 Pri = 165 Date of 12/31/2014 02:59'
$!:
$.:
$/:

lindsey at UbuntuDT-LDO:~/$ rsyslogd -v
rsyslogd 7.6.3, compiled with:
        FEATURE_REGEXP:                         Yes
        FEATURE_LARGEFILE:                      Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 32 (due to too-old json-c
lib)