Mailing List Archive: Leading whitespace

Leading whitespace

Jul 23, 2008, 2:04 PM

Post #1 of 3 (1065 views)

Right now I'm doing live logging of my http servers to my rsyslog host.
I've got this code on the rsyslog server:

$template RawMessage,"%msg%\n"
$template HttpAccessTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%"
$template HttpErrorTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%"

On the http servers I've got:

CustomLog "| /usr/bin/logger -p local1.info -t join.fedoraproject.org-access.log" combined
ErrorLog "| /usr/bin/logger -p local1.info -t join.fedoraproject.org-error.log"

It works great except for one thing. The logs have an additional
whitespace in front of each line. for example:

111.111.111.11 - - [23/Jul/2008:21:01:32 +0000] "GET /static/images/fedora-logo.png HTTP/1.1" 200 5354 "http://fedoraproject.org/static/css/fedora.css" "Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.8.1.15) Gecko/20080702Fedora/2.0.0.15-1.fc8 Firefox/2.0.0.15"

Any ideas?

-Mike

Leading whitespace [ In reply to ]

rgerhards at hq

Jul 24, 2008, 3:27 AM

Post #2 of 3 (1032 views)

Permalink

This is rooted in RFC 3164. A description can be found here:

http://lists.adiscon.net/pipermail/rsyslog/2008-July/000893.html

If you want to consistently get rid of that SP, you can remove it via
the property replacer. I think this works:

?$template RawMessage,"%msg:2%\n"

if not, then this ;)

??$template RawMessage,"%msg:2:2048%\n"

Let us know if that cured the problem.

Rainer

On Wed, 2008-07-23 at 16:04 -0500, Mike McGrath wrote:
> Right now I'm doing live logging of my http servers to my rsyslog host.
> I've got this code on the rsyslog server:
>
> $template RawMessage,"%msg%\n"
> $template HttpAccessTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%"
> $template HttpErrorTemplate,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/http/%APP-NAME%"
>
>
> On the http servers I've got:
>
> CustomLog "| /usr/bin/logger -p local1.info -t join.fedoraproject.org-access.log" combined
> ErrorLog "| /usr/bin/logger -p local1.info -t join.fedoraproject.org-error.log"
>
>
> It works great except for one thing. The logs have an additional
> whitespace in front of each line. for example:
>
> 111.111.111.11 - - [23/Jul/2008:21:01:32 +0000] "GET /static/images/fedora-logo.png HTTP/1.1" 200 5354 "http://fedoraproject.org/static/css/fedora.css" "Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.8.1.15) Gecko/20080702Fedora/2.0.0.15-1.fc8 Firefox/2.0.0.15"
>
> Any ideas?
>
> -Mike
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog

Leading whitespace [ In reply to ]

mmcgrath at redhat

Jul 24, 2008, 6:41 AM

Post #3 of 3 (1050 views)

Permalink

On Thu, 24 Jul 2008, Rainer Gerhards wrote:

> This is rooted in RFC 3164. A description can be found here:
>
> http://lists.adiscon.net/pipermail/rsyslog/2008-July/000893.html
>
> If you want to consistently get rid of that SP, you can remove it via
> the property replacer. I think this works:
>
> ?$template RawMessage,"%msg:2%\n"
>
> if not, then this ;)
>
> ??$template RawMessage,"%msg:2:2048%\n"
>
> Let us know if that cured the problem.
>

%msg:2:2048% seems to work perfectly, thank you.

-Mike