Default app-name value of Syslog handler in Audit Logging violates specification

1. Configure Audit Logging to log into (local) rsyslog and start server <audit-log> <formatters> <json-formatter name= "json-formatter" /> </formatters> <handlers> <file-handler name= "file" formatter= "json-formatter" path= "audit-log.log" relative-to= "jboss.server.data.dir" /> <syslog-handler name= "syslog-handler" formatter= "json-formatter" > <udp host= "127.0.0.1" port= "514" /> </syslog-handler> </handlers> <logger log-boot= " true " log-read-only= " false " enabled= " true " > <handlers> <handler name= "file" /> <handler name= "syslog-handler" /> </handlers> </logger> </audit-log> 2. Look into /var/log/messages file Note: the brackets must be escaped, JIRA doesn't allow me to stress it. Brackets [, ] used in grep command should be always preceded by a backslash sudo grep "JBoss[EAP]" /var/log/messages - there should be a few occurrences sudo grep "JBossEAP[" /var/log/messages - there should be no occurences 3. Stop server, change configuration to use app-name without space character and start it again <audit-log> <formatters> <json-formatter name= "json-formatter" /> </formatters> <handlers> <file-handler name= "file" formatter= "json-formatter" path= "audit-log.log" relative-to= "jboss.server.data.dir" /> <syslog-handler name= "syslog-handler" formatter= "json-formatter" app-name= "JBossEAP" > <udp host= "127.0.0.1" port= "514" /> </syslog-handler> </handlers> <logger log-boot= " true " log-read-only= " false " enabled= " true " > <handlers> <handler name= "file" /> <handler name= "syslog-handler" /> </handlers> </logger> </audit-log> 4. Look into /var/log/messages file again Note: the brackets must be escaped, JIRA doesn't allow me to stress it. Bracket [ used in grep command should be always preceded by a backslash sudo grep "JBossEAP[" /var/log/messages - there should be a few occurrences (that contains PID) now