[syslog-ng] Snare TAB characters converted to \011 are missing?
cdukes at gmail.com
Thu Jun 7 15:01:22 CEST 2012
Anyone have any idea?
On Wed, Jun 6, 2012 at 11:47 AM, Clayton Dukes <cdukes at gmail.com> wrote:
> Hi All,
> I have a user receiving messages from Snare but, for some reason,
> syslog-ng doesn't appear to be converting the TAB characters properly.
> Snare sends messages as:
> checksum (optional)
> I have verified using a sniffer on the syslog-ng server that the message
> format is coming in correctly with the TABs, but somehow the messages are
> leaving syslog-ng as:
> ...snip (full message clipped for brevity)
> Tue Jun 05 11:09:27 2012592SecuritySYSTEMUserSuccess Audit
> In the example above, it should be:
> Tue Jun 05 11:09:27 2012\011592\011Security\011SYSTEM\011User\011Success
> I've checked his syslog-ng.conf file and it is the normal one that comes
> with Ubuntu 12.4 LTS.
> Any idea what might be causing this?
> Clayton Dukes
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng