[syslog-ng] Can TAG field be terminated by space?

Tsurusawa Takeshi tsuru at grid.nii.ac.jp
Mon Oct 22 11:26:50 CEST 2007


Hi,

I'm using syslog-ng-2.0.5 and trying to store syslog messages into a DB table with
 a TAG field column.

But when TAG fileld is terminated with space character(' ') in syslog message, 
syslog-ng parser returns as TAG field not only TAG field but also some extra strings 
end with a colon(':') in CONTENT field.

For example,  if MSG part is "program abc: message...", syslog-ng returns
"program abc" as a TAG field.

According to the section 4.1.3 of RFC3164, a space character can also terminate a TAG field.

   The TAG is a string of
   ABNF alphanumeric characters that MUST NOT exceed 32 characters.  Any
   non-alphanumeric character will terminate the TAG field and will be
   assumed to be the starting character of the CONTENT field.  Most
   commonly, the first character of the CONTENT field that signifies the
   conclusion of the TAG field has been seen to be the left square
   bracket character ("["), a colon character (":"), or a space
   character.  

Is it possible to change this behavior of syslog-ng?

Thanks in advance.

-- 
Tsurusawa Takeshi <tsuru at grid.nii.ac.jp>


More information about the syslog-ng mailing list