[syslog-ng] Syslog-NG, log4j, tabs, whitespace, indent

[John Skopis]

Bazsi,

Strace:
recvfrom(5, "<147>    at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75
write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97
recvfrom(5, "<147>    at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75
write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97

Let me know if you need tcpdump still (I started the cap but would like to anonymize it and/or send it to you off-list).

Thanks,
John Skopis
Systems Administrator
Backstop Solutions Group


> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-
> bounces at lists.balabit.hu] On Behalf Of Balazs Scheidler
> Sent: Wednesday, December 10, 2008 4:38 PM
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] Syslog-NG, log4j, tabs, whitespace, indent
> 
> On Wed, 2008-12-10 at 15:30 -0600, John Skopis wrote:
> > Hello,
> > I believe that the log4j SyslogAppender is sending logs to syslog-ng
> that begin with a '\t' (or four spaces).
> >
> > The leading whitespace is trimmed either because it's not allowed per
> the syslog RFC, or for some other (hopefully) good reason.
> >
> > Can I turn this behavior off?
> >
> > an example would be a message:
> > Dec 10 16:17:52 testbox at java.lang.Thread.run(Thread.java:619)
> > which should be
> > Dec 10 16:17:52 testbox \tat java.lang.Thread.run(Thread.java:619)
> 
> I've just checked with syslog-ng OSE 2.1, and the tabs stay where they
> are. It should be the same with syslog-ng OSE 2.0
> 
> Can you strace/tcpdump the exact traffic as it is received by syslog-
> ng?
> 
> --
> Bazsi
> 
> 
> _______________________________________________________________________
> _______
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html