Bazsi, Strace: recvfrom(5, "<147> at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75 write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97 recvfrom(5, "<147> at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75 write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97 Let me know if you need tcpdump still (I started the cap but would like to anonymize it and/or send it to you off-list). Thanks, John Skopis Systems Administrator Backstop Solutions Group
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng- bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, December 10, 2008 4:38 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-NG, log4j, tabs, whitespace, indent
On Wed, 2008-12-10 at 15:30 -0600, John Skopis wrote:
Hello, I believe that the log4j SyslogAppender is sending logs to syslog-ng that begin with a '\t' (or four spaces).
The leading whitespace is trimmed either because it's not allowed per the syslog RFC, or for some other (hopefully) good reason.
Can I turn this behavior off?
an example would be a message: Dec 10 16:17:52 testbox at java.lang.Thread.run(Thread.java:619) which should be Dec 10 16:17:52 testbox \tat java.lang.Thread.run(Thread.java:619)
I've just checked with syslog-ng OSE 2.1, and the tabs stay where they are. It should be the same with syslog-ng OSE 2.0
Can you strace/tcpdump the exact traffic as it is received by syslog- ng?
-- Bazsi
_______________________________________________________________________ _______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html