1

I would like to be able to send a RFC5452-format message to rsyslog using the /dev/log socket. I've tried a number of variations on the following:

echo "<29>1 2003-10-11T22:14:15Z mymachine.example.com su - ID47 - 'su root' failed for lonvick on /dev/pts/8" | socat - UNIX-SENDTO:/dev/log

But whatever I've tried, I think it seems to fail to be a RFC5452 message and instead treats it as an older and less structured format. More specifically, that line above generates this line in the log file:

<29> t=2015-07-13T08:10:20.542111+00:00 h=vm01[-] a=1 m=- sd='-' msg=' 2003-10-11T22:14:15Z mymachine.example.com su - ID47 -'su root' failed for lonvick on /dev/pts/8'

where the template is

$template my-rfc5424,"<%PRI%> t=%TIMESTAMP:::date-rfc3339% h=%HOSTNAME%[%PROCID%] a=%APP-NAME% m=%MSGID% sd='%STRUCTURED-DATA%' msg='%msg%'\n"

%APP-NAME% is coming out as 1 - that's the character after <29> (if I change that to 2 then %APP-NAME% comes out as 2 as well). All other fields are coming out as - and then the message itself is everything else, leading space and all.

Is that not a valid RFC5452-formatted message and, if not, how should it be fixed to be one?

0

You must log in to answer this question.

Browse other questions tagged .