Listening with netcat on UDP 514 to syslog data I see that each sent log message is separated by <134>.
Does anyone note what <134> is?
asked Apr 5, 2011 at 23:34
-
Ah okay it is defined in tools.ietf.org/html/rfc5424#section-6.2 -- trying to parse that :-)– Kyle BrandtApr 5, 2011 at 23:46
Add a comment
|
2 Answers
That is part of the header. "The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity." So 134 / 8 = 16 (facility local0) remainder 6 (severity Informational: informational messages).
SYSLOG-MSG = HEADER SP STRUCTURED-DATA [SP MSG]
HEADER = PRI...
PRI = "<" PRIVAL ">"
PRIVAL = 1*3DIGIT ; range 0 .. 191
answered Apr 5, 2011 at 23:57
0134 is the octal code for backslash \.
This is an escape char, to avoid possible sql injections on syslog SQL backends.
See this message on the syslog-ng mailing list.
