5

I am using rsyslog to collect nginx logs. All looks good except the replacing usual tabs with '#011' text.

Example of corrupted output:

217.118.93.88#0111473674833.412#0114418687#011...

How it should look:

217.118.93.88    1473674833.412    4418687    ...

Why it is happens and how to disable such replacing?

Thanks!

Samriang
  • 403
  • 6
  • 18
  • Welcome to StackOverflow! This site is intended as a programming Q&A. For questions like this about server configuration, you might want to head over to http://SuperUser.com or http://unix.stackexchange.com/. – ghoti Sep 12 '16 at 10:21
  • Thanks for pointing! – Samriang Sep 16 '16 at 08:37

2 Answers2

4

Try this (which was an undocumented option as far as I could see and found it by skimming through source code):

global(
  parser.escapecontrolcharactertab="off"
)

There is an issue for this on https://github.com/rsyslog/rsyslog/issues/552.

JPvRiel
  • 231
  • 2
  • 9
2

The "quick dirty" fix is to disable escaping special characters.

Add in rsyslog.conf

$EscapeControlCharactersOnReceive off

Despite it is acceptable solution for my case it could be harmful for more complex situations.

Samriang
  • 403
  • 6
  • 18