[syslog-ng] Syslog-NG, log4j, tabs, whitespace, indent

[Balazs Scheidler]

On Wed, 2008-12-10 at 16:55 -0600, John Skopis wrote:
> Bazsi,
> 
> Strace:
> recvfrom(5, "<147>    at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75
> write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97
> recvfrom(5, "<147>    at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)", 8192, 0, {sa_family=AF_INET, sin_port=htons(41277), sin_addr=inet_addr("1.2.3.4")}, [16]) = 75
> write(14, "Dec 10 17:52:04 1.2.3.4 at org.jgroups.util.TimeScheduler$Loop.run(TimeScheduler.java:141)\n", 97) = 97
> 
> Let me know if you need tcpdump still (I started the cap but would like to anonymize it and/or send it to you off-list).
> 

Ah, this means that there's no tab at the beginning of the message, but
rather it is a space. syslog-ng skips spaces if the syslog header is not
complete.

Try enabling setHeader(true) on your SyslogAppender class. This will
probably make log4j emit a complete syslog header, in which case
syslog-ng will not drop the preceding spaces.

Please let me know if this works for you. 

-- 
Bazsi