Bug 1517455

Summary: why become tabs to #011
Product: [Fedora] Fedora Reporter: Harald Reindl <h.reindl>
Component: rsyslogAssignee: Jiří Vymazal <jvymazal>
Status: CLOSED UPSTREAM QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: dkopecek, h.reindl, jlieskov, jvymazal, lkundrak, mah.darade, rsroka, tosykora
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-12-11 13:30:53 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Harald Reindl 2017-11-25 14:32:29 UTC
-------- Weitergeleitete Nachricht --------
Betreff: 	Re: [systemd-devel] journald: why become tabs to #011
Datum: 	Sat, 25 Nov 2017 16:22:19 +0200
Von: 	Mantas Mikul?nas <grawity>
An: 	Reindl Harald <h.reindl>
Kopie (CC): 	Mailing-List systemd <systemd-devel.org>

That's done by rsyslogd, not journald.

[pid  3345] recvmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="<13>Nov 25 16:20:45 grawity: foo bar\tbaz\nquux", iov_len=8096}], msg_iovlen=1, msg_control=[...], msg_controllen=64, msg_flags=0}, MSG_DONTWAIT) = 45
[pid  3351] write(17, "Nov 25 14:20:45 virgule grawity: foo bar#011baz#012quux\n", 56) = 56


On Sat, Nov 25, 2017 at 3:39 PM, Reindl Harald <h.reindl <h.reindl>> wrote:

    this is terrible ugly and it makes little sense - in doubt please
    convert that to a space and not #011

    Nov 25 05:45:02 testserver php[16259]: 2017-11-25 04:45:02 [notice]
    Daily renewal check started
    Nov 25 06:30:02 testserver php[16680]: 2017-25-11
    06:30:02#011/cms/temp/ecparams.pem#0110,10 KB
    Nov 25 06:30:02 testserver php[16680]: 2017-25-11 06:30:02#0110,10 KB

Comment 1 Jiří Vymazal 2017-12-11 09:40:25 UTC
Could you please try with:

global(parser.escapeControlCharactersOnReceive="on")

and post whether that helps in your case?

Comment 2 Harald Reindl 2017-12-11 09:50:50 UTC
no and i wouldn't call it smart don't escape any control chars but tabs which are simply useful so taht you can open a logfile in libreoffice as CSV for example

rsyslog.conf (what is that for weird syntax now)
global(parser.escapeControlCharactersOnReceive="on")


<?php
syslog(LOG_NOTICE, "1\t2\t\3");
?>

Dec 11 10:48:32 srv-rhsoft php[21262]: 1#0112#011#003

Comment 3 Jiří Vymazal 2017-12-11 12:55:05 UTC
I am sorry, looking at my previous comment, I mis-typed the value, I meant "off" of course. so please try with:

global(parser.escapeControlCharactersOnReceive="off")

and BTW this "new" syntax is around from about 2013.

Comment 4 Harald Reindl 2017-12-11 13:11:57 UTC
looks better - \0 seems to be killed by journald already
linebreaks are not much funny but better than tabs replaced by #011

[root@srv-rhsoft:~]$ > messages
[root@srv-rhsoft:~]$ cat /downloads/test.php
<?php
syslog(LOG_NOTICE, "1\t2\t3 test\ntest");
?>
[root@srv-rhsoft:~]$ php /downloads/test.php
[root@srv-rhsoft:~]$ cat messages
Dec 11 13:59:11 srv-rhsoft php[23633]: 1        2       3 test
test

Comment 5 Jiří Vymazal 2017-12-11 13:30:53 UTC
This default behavior comes from backwards compatibility with ancient versions, as you can see it can be overridden, but then you have to live with line-breaks as well. You can see linked upstream issue for discussion how this could be solved, however no conclusion has been reached there so far.