Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-5647

Vector syslog output for RFC3164 has extra space that does not comply with spec

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Prior to this change the logforwarder introduced an extra space in the message payload which did not confirm to the RFC3164 spec. This fix removes the extraneous space.
    • Bug Fix
    • Log Collection - Sprint 255, Log Collection - Sprint 256
    • Moderate

      Description of problem: 

      Logforwarding using RFC3164 has an extra space that is not compliant with spec.

      For example:

      This is how it looks:

      <182> Jun 5 15:06:01 server.example.com

      This is how it should look according to spec:

      <182>Jun 5 15:06:01 server.example.com 

      Notice the <SPACE> directly after the ">" in <182>. There should not be a space according to the spec[1] which states:

      The HEADER contains two fields called the TIMESTAMP and the HOSTNAME. The TIMESTAMP will immediately follow the trailing ">" from the PRI part and single space characters MUST follow each of the TIMESTAMP and HOSTNAME fields.

      [1] https://datatracker.ietf.org/doc/html/rfc3164#section-4.1.2

      Version-Release number of selected component (if applicable):

      openshift-logging: 5.8.5

      openshift: 4.12.40

      collector: vector

      How reproducible:

      Steps to Reproduce:

      1.  
      2.  
      3. ...

      Actual results:

      <182> Jun 5 15:06:01 server.example.com

      Expected results:

      <182>Jun 5 15:06:01 server.example.com

      Additional info:

            jcantril@redhat.com Jeffrey Cantrill
            rhn-support-wmattson Wesley Mattson
            Kabir Bharti Kabir Bharti
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: