[rsyslog-notify] Forum Thread: Filtering messages containing specific characters CR LF - (Mode 'post')

[noreply at adiscon.com]

User: johnwigley 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26223#p26223

Message: 
----------
Hi,

I've been struggling to get Rsyslog to filter on messages containing
specific control characters such as Carriage Return, and Linefeed.

I've tried constructs similar to:

1)
if $msg contains '--->\x0D\x0A\x0D\x0A\x0D\x0A<---' then ~

2)
if $msg contains '--->\r\n\r\n\r\n\r\n<---' then ~

3)
$template blanksipmsg4,"--->\x0A\x0D\x0A\x0D\x0A\x0A\<---"
if $msg contains exec_template('blanksipmsg4') then ~

but they don't seem to match on messages containing those characters.

What's the easiest way to achieve a filter condition on CR, LF and any
other specific control characters?

I don't mind which of the different syntax's is used, or how the end result
is achieved.

Many thanks for any advice?