Why is the message output from rsyslog different between RHEL 6 and RHEL 8?

Solution Unverified - Updated -

Issue

When we use udp communication to output messages via rsyslog, the output results are different between RHEL 7 (and prior) and RHEL 8 (and newer). If a character '[' or '{' is placed just after the priority in the message, rsyslog inserts one extra space into /var/log/messages.

    - RHEL 8
     # exec 3<>/dev/udp/127.0.0.1/514
     # echo -e "<158>[t-msg" >&3
     Aug  1 11:26:42 localhost  [t-msg

    - RHEL 6
     # exec 3<>/dev/udp/127.0.0.1/514
     # echo -e "<158>[t-msg" >&3
     Jul 31 13:46:36 localhost [t-msg 

Currently, we confirmed the following:

  • This issue does not occur with RHEL 7.9.
  • This issue occurs with RHEL 8.0 and also with 8.9 Nightly Builds.
  • Checking the rsyslog debug format, RHEL 6 interprets "[t-msg" as a syslogtag property, while RHEL 8 interprets it as a msg property. We think the difference in format occurs because RHEL 8 conforms to RFC 5424 but RHEL 6 conforms to RFC 3124..

Could you answer the following questions?

  • Could you tell us the reason why a space character is added in RHEL 8?
  • Could you tell us the workaround?
  • Are there any other characters which this issue occurs?

Environment

  • Red Hat Enterprise Linux (RHEL) 8
  • rsyslog

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content