[rsyslog-notify] Forum Thread: Re: Strange linebreak with Jboss access logs - (Mode 'reply')

[noreply at adiscon.com]

User: rgerhards 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24273#p24273

Message: 
----------
This indeed looks strange. Can you provide a debug log? The messages are
definitely different, and it looks like they were sent via two different
templates.

In any case, I see the problem in your template. It's neither RFC3164 nor
RFC5424, because you have a RFC5424 version field inside an otherwise
RFC3164 message. Also, "date-rfc8601A" is an invalid property modifier.
Didn't rsyslog complain on startpup? Appname is also invalid in the place
where you put it. That all is causing the parsing error.  The template
should probably look like this (I have *not* tested):

[code:2136w3kr]$template FormatJB1Access,"<188>%TIMESTAMP% %HOSTNAME%
%syslogtag% %msg:::sp-if-no-1st-sp%%msg%\n"[/code:2136w3kr]

But a debug log would be useful to understand what really is going on. See
this page on how to generate one:

<!-- m --><a class="postlink"
href="http://www.rsyslog.com/doc/troubleshoot.html">http://www.rsyslog.com/doc/troubleshoot.html</a><!--
m -->

Rainer