[rsyslog-notify] Forum Thread: Re: Unix socket with rfc5424 messages - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24557#p24557

Message: 
----------
unix sockets aren't expecting a RFC5424 formatted message, so that's why it
gets parsed wrong. I'm not sure if you can configure different parsers for
the unix socket

But what you can do is enable trusted properties and get the information
about the sending app from that.

unfortunately, RFC5424 has basically been ignored by everyone except the
authors of syslog servers (and even there, they support it, but very few
people actually use it)

What does seem to be gaining traction is putting JSON structured logs in
the msg part of the log.