On Wed, 2008-12-10 at 16:55 -0600, John Skopis wrote:
Bazsi,
Strace: recvfrom(5, "<147> at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75 write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97 recvfrom(5, "<147> at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75 write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97
Let me know if you need tcpdump still (I started the cap but would like to anonymize it and/or send it to you off-list).
Ah, this means that there's no tab at the beginning of the message, but rather it is a space. syslog-ng skips spaces if the syslog header is not complete. Try enabling setHeader(true) on your SyslogAppender class. This will probably make log4j emit a complete syslog header, in which case syslog-ng will not drop the preceding spaces. Please let me know if this works for you. -- Bazsi