[rsyslog-notify] Forum Thread: Re: linefeed character in message - (Mode 'reply')

[noreply at adiscon.com]

User: dhaivat.desai 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24419#p24419

Message: 
----------
[quote="rgerhards":23jhpxj5]Do you actually need an additional frame
delimiter of NUL? This sounds rather strange...[/quote:23jhpxj5]

Actually our legacy applications are time-to-time generating multi-line
messages that ends with NULL. It is not possible to change these
applications.
It is still ok if rsyslog breaks down one multi-line message into multiple
individual messages and log them in new line. But the worst part is - the
message content after [b:23jhpxj5]\n(line-feed)[/b:23jhpxj5] is considered
as [b:23jhpxj5]a new message with header[/b:23jhpxj5] and rsyslog starts
parsing the message content as header and that's where everything goes
wrong..!

By the way, I read that SupportOctetCountedFraming is on by default. So our
client application is now sending multi-line message in rfc5425(MSG-LEN SP
rfc5424) format and these messages, by rsyslog, are now received and
processed based on the message length provided and not by LF delimiter.

The message logged by rsyslog looks as follow:
2014-03-21T12:31:11.767903Z NOT: This is a multi-line message part
1.[b:23jhpxj5]#012[/b:23jhpxj5]This is a multi-line message part
2.[b:23jhpxj5]#012[/b:23jhpxj5]This is a multi-line message part 3. from
Thread-3:2

The only problem is [b:23jhpxj5]\n[/b:23jhpxj5] in the log-message is
replaced with its octal equivalent value(#012).
Is it possible to keep [b:23jhpxj5]\n[/b:23jhpxj5] in the message as it is
when logging.

Best Reagrds,
Dhaivat Desai.