4

We have a Java application logging structured data (MDC with log4j) via syslog to rsyslog (7.6.3) on localhost. localhost should then forward these log messages to a central logging host (also running rsyslog (7.4.4)) which will format the log messages and distribute them into files.

The problem is that we see the structured data on localhost (by logging %rawmsg% to a file), but there is no structured data in the %rawmsg% as received on the logging server. The forwading is done via UDP.

How can we transfer the structured data as structured data via rsyslog?

Martin Schröder
  • 315
  • 1
  • 5
  • 24

1 Answers1

4

The standard template for remote forwarding uses a traditional BSD Syslog format. Try to use the predefined template RSYSLOG_SyslogProtocol23Format to forward in syslog-protocol format with structured data. E.g.:

*.* @logserver;RSYSLOG_SyslogProtocol23Format
Community
  • 1
mschuett
  • 3,146
  • 21
  • 21