Why is the message output from rsyslog different between RHEL 6 and RHEL 8?
Issue
When we use udp communication to output messages via rsyslog, the output results are different between RHEL 7 (and prior) and RHEL 8 (and newer). If a character '[' or '{' is placed just after the priority in the message, rsyslog inserts one extra space into /var/log/messages.
- RHEL 8
# exec 3<>/dev/udp/127.0.0.1/514
# echo -e "<158>[t-msg" >&3
Aug 1 11:26:42 localhost [t-msg
- RHEL 6
# exec 3<>/dev/udp/127.0.0.1/514
# echo -e "<158>[t-msg" >&3
Jul 31 13:46:36 localhost [t-msg
Currently, we confirmed the following:
- This issue does not occur with RHEL 7.9.
- This issue occurs with RHEL 8.0 and also with 8.9 Nightly Builds.
- Checking the rsyslog debug format, RHEL 6 interprets "[t-msg" as a syslogtag property, while RHEL 8 interprets it as a msg property. We think the difference in format occurs because RHEL 8 conforms to RFC 5424 but RHEL 6 conforms to RFC 3124..
Could you answer the following questions?
- Could you tell us the reason why a space character is added in RHEL 8?
- Could you tell us the workaround?
- Are there any other characters which this issue occurs?
Environment
- Red Hat Enterprise Linux (RHEL) 8
- rsyslog
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.