syslog message format question

Question

is there a way with rsyslog or syslog-ng to allow tab delimited messages? I'm currently using rsyslog and the c syslog() function to generate syslog messages from within my app. The problem is that I use \t and they get translated into #011 when I view the logs. Ideally I'd like to have the other control chars translated except tab. is something like this possible?

You might want to ask this on Stack Overflow instead. Sounds like a developer question. That being said, what app are you using to view the logs? — romandas, Aug 07 '09 at 02:33

score 2 · Answer 1 · answered Aug 15 '09 at 22:26

2

syslog-ng will pass tabs

answered Aug 15 '09 at 22:26

score 0 · Answer 2 · edited Oct 02 '15 at 04:32

You definitely can with syslog-ng - not sure about rsyslog. To do it in syslog-ng, you simply add a \t in the tokens.

The syslog tool I use employs tab delimiters, here's the config for it:

destination d_logzilla {
   program("/www/logzilla/scripts/db_insert.pl"
   template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
   template_escape(yes)
   );
};

And here's a short video on how to configure syslog-ng from their site: http://www.logzilla.pro/syslog-ng-configuration

syslog message format question

2 Answers2