Mailing List Archive

Escaping is done on input so you can't disable it on output. You could
try to "unescape" it but there's no way of knowing if - for example -
#11 is a literal string or escaped tab character.
I don't remember if you can disable escaping or single input or is it a
global setting.


On October 5, 2022 4:45:22 PM UTC, Felipe Gasper via rsyslog
<rsyslog@lists.adiscon.com> wrote:

Hello,

I’d like to create a template that preserves newlines & tabs in the original message (i.e., doesn’t octal-escape them). I’d also like, though, not to alter rsyslog’s global configuration.

Is it possible to disable rsyslog’s control-character escaping locally?

Thank you!

cheers,
-Felipe Gasper
------------------------------------------------------------------------
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Followhttps://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

El jue, 6 oct 2022 a las 8:20, Mariusz Kruk via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Escaping is done on input so you can't disable it on output. You could
> try to "unescape" it but there's no way of knowing if - for example -
> #11 is a literal string or escaped tab character.
> I don't remember if you can disable escaping or single input or is it a
> global setting.

It's global. We could not envision that someone would need to do that
on an per-input level.

Bottom line: the control characters usually cause large issues inside
the analysis pipeline.

One approach would be to disable escaping globally and escape via
template in those actions that need it.

Rainer

>
>
> On October 5, 2022 4:45:22 PM UTC, Felipe Gasper via rsyslog
> <rsyslog@lists.adiscon.com> wrote:
>
> Hello,
>
> I’d like to create a template that preserves newlines & tabs in the original message (i.e., doesn’t octal-escape them). I’d also like, though, not to alter rsyslog’s global configuration.
>
> Is it possible to disable rsyslog’s control-character escaping locally?
>
> Thank you!
>
> cheers,
> -Felipe Gasper
> ------------------------------------------------------------------------
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Followhttps://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

> On Oct 6, 2022, at 03:41, Rainer Gerhards via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> El jue, 6 oct 2022 a las 8:20, Mariusz Kruk via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
>>
>> Escaping is done on input so you can't disable it on output. You could
>> try to "unescape" it but there's no way of knowing if - for example -
>> #11 is a literal string or escaped tab character.
>> I don't remember if you can disable escaping or single input or is it a
>> global setting.
>
> It's global. We could not envision that someone would need to do that
> on an per-input level.
>
> Bottom line: the control characters usually cause large issues inside
> the analysis pipeline.
>
> One approach would be to disable escaping globally and escape via
> template in those actions that need it.

Making global changes is a bit more aggressive than I’d like to be, especially since we don’t fully control the servers that run our software.

Our application writes (directly) to its own log file. We’d like to extend that application such that plugins can log to the original application’s log file, but without asking the plugins to append directly to the same log file.

We’d rather tell those plugins to use syslog, and configure rsyslog to append to the log file. The original application, though, sometimes prints stack traces in its log that are useful for debugging. Those stack traces from plugins will be less legible if they have octal escapes rather than newlines and tabs.

It’s not a huge deal, but I thought I’d ask anyway.

cheers,
-Felipe Gasper
Mississauga, Ontario
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

El jue, 6 oct 2022 a las 14:54, Felipe Gasper via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
>
> > On Oct 6, 2022, at 03:41, Rainer Gerhards via rsyslog <rsyslog@lists.adiscon.com> wrote:
> >
> > El jue, 6 oct 2022 a las 8:20, Mariusz Kruk via rsyslog
> > (<rsyslog@lists.adiscon.com>) escribió:
> >>
> >> Escaping is done on input so you can't disable it on output. You could
> >> try to "unescape" it but there's no way of knowing if - for example -
> >> #11 is a literal string or escaped tab character.
> >> I don't remember if you can disable escaping or single input or is it a
> >> global setting.
> >
> > It's global. We could not envision that someone would need to do that
> > on an per-input level.
> >
> > Bottom line: the control characters usually cause large issues inside
> > the analysis pipeline.
> >
> > One approach would be to disable escaping globally and escape via
> > template in those actions that need it.
>
> Making global changes is a bit more aggressive than I’d like to be, especially since we don’t fully control the servers that run our software.
>
> Our application writes (directly) to its own log file. We’d like to extend that application such that plugins can log to the original application’s log file, but without asking the plugins to append directly to the same log file.
>
> We’d rather tell those plugins to use syslog, and configure rsyslog to append to the log file. The original application, though, sometimes prints stack traces in its log that are useful for debugging. Those stack traces from plugins will be less legible if they have octal escapes rather than newlines and tabs.

I would actually recommend to have an option inside the application to
use the 2-char sequence "\n" rather than LF for "multi-line" messages.
This makes processing so much easier. And it is simple to convert it
to real multiline if needed.

Just my 2cts ;-)

Rainer

>
> It’s not a huge deal, but I thought I’d ask anyway.
>
> cheers,
> -Felipe Gasper
> Mississauga, Ontario
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.