You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This lib assumes that the PRI and version will be included in a log. While this is in the spec/RFC and sent on the network, it is standard practice to not write this to disk, but instead it is used by syslog software to choose which file to write it to, and strip it before writing to disk so the first component of the log is the date/timestamp. Situations where syslog is pulled from disk and parsed with this library will all fail with a syntax error. I would suggest making the PRI field optional =)
Some evidence of my claims:
rsyslog documentation explaining that PRI fields are sent but not recorded here.
The rsyslog built-in templates for writing to disk exclude PRI (details). Note that they are retained in some cases, but in situations such as forwarding to another syslog server or in the still-draft ietf-syslog-protocol-23 format.
Even legacy file formats only include PRI when forwarding (details).
Back in 2010 the SUSE syslog-ng format defaults to writing without PRI.
The text was updated successfully, but these errors were encountered:
This lib assumes that the PRI and version will be included in a log. While this is in the spec/RFC and sent on the network, it is standard practice to not write this to disk, but instead it is used by syslog software to choose which file to write it to, and strip it before writing to disk so the first component of the log is the date/timestamp. Situations where syslog is pulled from disk and parsed with this library will all fail with a syntax error. I would suggest making the PRI field optional =)
Some evidence of my claims:
The text was updated successfully, but these errors were encountered: