This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 843384 - different letter case in incoming logs
different letter case in incoming logs
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: rsyslog (Show other bugs)
5.8
Unspecified Unspecified
medium Severity low
: rc
: ---
Assigned To: Tomas Heinrich
BaseOS QE Security Team
: EasyFix, Patch
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-26 04:16 EDT by Karel Srot
Modified: 2014-07-16 09:13 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-07-16 09:13:11 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
proposed patch (3.01 KB, patch)
2012-09-05 05:36 EDT, mahaveer darade
no flags Details | Diff

  None (edit)
Description Karel Srot 2012-07-26 04:16:09 EDT
Description of problem:

rsyslog should unify letter case and spaces in date in incoming messages:

Version-Release number of selected component (if applicable):
rsyslog-3.22.1-7.el5

How reproducible:
always

Steps to Reproduce:
1. configure rsyslogd to listen on port 514
2. Connect with netcat to port 514
# nc localhost 514
and send several messages such as
<135>jun  4 09:03:41 dhcp-30-102 userx: local0.debug test message
<134>JUN  4 09:03:49  dhcp-30-102 userx: local0.info test message
<142>Jun 4 09:04:09   dhcp-30-102 userx: local1.info test message
Then check that all messages were logged to /tmp/tcp.log and the case is unified (Jun 4)
  

Actual results:
Jul 25 05:16:39 localhost.localdomain jun 4 09:03:41 dhcp-30-102 userx: local0.debug test message
Jul 25 05:16:39 localhost.localdomain JUN 4 09:03:49  dhcp-30-102 userx: local0.info test message


Expected results:
dates are in same format (Jun 4)

Additional info:
This is working fine on RHEL6.
Comment 1 mahaveer darade 2012-09-04 09:55:46 EDT
When you say its working fine with RHEL6, does it mean its displaying date in "JUN 4" format? i.e. after unifying case? I used %TIMESTAMP% template with both the supported rfc's (3164,3339) & its displaying date in 2012-06-04 format only.

I need this information so that I can take a call on whether to simply put toupper() in msgConstructWithTime() or check for RHEL-6 code changes (which I haven't come across yet).
Comment 2 Karel Srot 2012-09-04 10:11:34 EDT
Hi,
on RHEL6 the date is displayed as "Jun  4", e.g. "Jun  4 09:03:41"
note those 2 blank chars... day is probably ljustified to 2 characters, 
'Jun   14' is converted to 'Jun 14'.
Comment 4 mahaveer darade 2012-09-04 12:59:20 EDT
I feel below is the culprit in ParseTIMESTAMP3164() as it doesn't consider string as JUN, jun, juN etc. I will try to check with private build tomorrow whether after considering all cases it works or not.

338     case 'J':
339         if(*pszTS == 'a') {
340             ++pszTS;
341             if(*pszTS == 'n') {
342                 ++pszTS;
343                 month = 1;
344             } else
345                 ABORT_FINALIZE(RS_RET_INVLD_TIME);
346         } else if(*pszTS == 'u') {
347             ++pszTS;
348             if(*pszTS == 'n') {
Comment 5 mahaveer darade 2012-09-05 05:36:54 EDT
Created attachment 609946 [details]
proposed patch

Have verified and its working fine.
Comment 6 RHEL Product and Program Management 2013-05-01 02:57:39 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 7 RHEL Product and Program Management 2013-05-01 03:00:25 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 8 RHEL Product and Program Management 2013-05-01 03:01:58 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 9 RHEL Product and Program Management 2013-05-01 03:04:18 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 10 RHEL Product and Program Management 2014-03-07 07:18:30 EST
Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in the  last planned RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX. To request that Red Hat re-consider this request, please re-open the bugzilla via  appropriate support channels and provide additional business and/or technical details about its importance to you.
Comment 11 Ondrej Vasik 2014-07-16 09:13:11 EDT
I take it as no need to escalate, closing WONTFIX, as we are in production phase 3 in RHEL 5 and it works properly on RHEL 6.

Note You need to log in before you can comment on or make changes to this bug.