I would like to be able to send a RFC5452-format message to rsyslog using the /dev/log
socket. I've tried a number of variations on the following:
echo "<29>1 2003-10-11T22:14:15Z mymachine.example.com su - ID47 - 'su root' failed for lonvick on /dev/pts/8" | socat - UNIX-SENDTO:/dev/log
But whatever I've tried, I think it seems to fail to be a RFC5452 message and instead treats it as an older and less structured format. More specifically, that line above generates this line in the log file:
<29> t=2015-07-13T08:10:20.542111+00:00 h=vm01[-] a=1 m=- sd='-' msg=' 2003-10-11T22:14:15Z mymachine.example.com su - ID47 -'su root' failed for lonvick on /dev/pts/8'
where the template is
$template my-rfc5424,"<%PRI%> t=%TIMESTAMP:::date-rfc3339% h=%HOSTNAME%[%PROCID%] a=%APP-NAME% m=%MSGID% sd='%STRUCTURED-DATA%' msg='%msg%'\n"
%APP-NAME%
is coming out as 1
- that's the character after <29>
(if I change that to 2
then %APP-NAME%
comes out as 2
as well). All other fields are coming out as -
and then the message itself is everything else, leading space and all.
Is that not a valid RFC5452-formatted message and, if not, how should it be fixed to be one?