RFC5424 support?

Question

RFC5424 support?

Opened this issue a year ago · 7 comments

l29ah commented a year ago

metalog seems to ignore syslog messages sent to /dev/log that satisfy the RFC.

Is there a doc on what kind of syntax does metalog actually expect?

Answer 1 · 2024-03-09T19:51:41.000Z

Do you have an example, what syslog message sent to /dev/log gets ignored?

The only doc regarding the syntax seems to be the code. What exactly is the issue?

Answer 2 · 2024-03-09T19:53:50.000Z

My real issue is haskell-hvr/hslogger#17 (that is also not-RFC5424 tho).
I don't have an example at hand rn.

Answer 3 · 2024-03-09T20:06:09.000Z

It would be very helpful having an example that works with syslog-ng and not with metalog.
In metalog.c that line might get eliminated in parseLogLine()

Answer 4 · 2024-03-09T20:16:34.000Z

Built an example from that issue report, it yields this in strace: [pid 5717] sendto(16, "<11>: [/ERROR] This won't show up with metalog.\0", 48, 0, NULL, 0) = 48.

Answer 5 · 2024-03-09T20:42:04.000Z

It seems as metalog expects a ":" after the [xyz], e.g.
<11>: [/ERROR]: This might show up with metalog

Obviously metalog has been loosely written for RFC3164 (BSD syslog).

Answer 6 · 2024-03-09T21:01:40.000Z

Adding a ":" doesn't change the behavior it seems.

Answer 7 · 2024-07-12T16:10:09.000Z

You could test again with ": " (space after colon).
Metalog works like described in RFC3164, not like the predecessor RFC5424. Please also look at the other issue #32