Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1517455 - why become tabs to #011
Summary: why become tabs to #011
Alias: None
Product: Fedora
Classification: Fedora
Component: rsyslog
Version: rawhide
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Jiří Vymazal
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2017-11-25 14:32 UTC by Harald Reindl
Modified: 2017-12-11 13:30 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-12-11 13:30:53 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Github rsyslog rsyslog issues 552 None None None 2017-12-11 09:40:25 UTC

Description Harald Reindl 2017-11-25 14:32:29 UTC
-------- Weitergeleitete Nachricht --------
Betreff: 	Re: [systemd-devel] journald: why become tabs to #011
Datum: 	Sat, 25 Nov 2017 16:22:19 +0200
Von: 	Mantas Mikul?nas <>
An: 	Reindl Harald <>
Kopie (CC): 	Mailing-List systemd <>

That's done by rsyslogd, not journald.

[pid  3345] recvmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="<13>Nov 25 16:20:45 grawity: foo bar\tbaz\nquux", iov_len=8096}], msg_iovlen=1, msg_control=[...], msg_controllen=64, msg_flags=0}, MSG_DONTWAIT) = 45
[pid  3351] write(17, "Nov 25 14:20:45 virgule grawity: foo bar#011baz#012quux\n", 56) = 56

On Sat, Nov 25, 2017 at 3:39 PM, Reindl Harald < <>> wrote:

    this is terrible ugly and it makes little sense - in doubt please
    convert that to a space and not #011

    Nov 25 05:45:02 testserver php[16259]: 2017-11-25 04:45:02 [notice]
    Daily renewal check started
    Nov 25 06:30:02 testserver php[16680]: 2017-25-11
    06:30:02#011/cms/temp/ecparams.pem#0110,10 KB
    Nov 25 06:30:02 testserver php[16680]: 2017-25-11 06:30:02#0110,10 KB

Comment 1 Jiří Vymazal 2017-12-11 09:40:25 UTC
Could you please try with:


and post whether that helps in your case?

Comment 2 Harald Reindl 2017-12-11 09:50:50 UTC
no and i wouldn't call it smart don't escape any control chars but tabs which are simply useful so taht you can open a logfile in libreoffice as CSV for example

rsyslog.conf (what is that for weird syntax now)

syslog(LOG_NOTICE, "1\t2\t\3");

Dec 11 10:48:32 srv-rhsoft php[21262]: 1#0112#011#003

Comment 3 Jiří Vymazal 2017-12-11 12:55:05 UTC
I am sorry, looking at my previous comment, I mis-typed the value, I meant "off" of course. so please try with:


and BTW this "new" syntax is around from about 2013.

Comment 4 Harald Reindl 2017-12-11 13:11:57 UTC
looks better - \0 seems to be killed by journald already
linebreaks are not much funny but better than tabs replaced by #011

[root@srv-rhsoft:~]$ > messages
[root@srv-rhsoft:~]$ cat /downloads/test.php
syslog(LOG_NOTICE, "1\t2\t3 test\ntest");
[root@srv-rhsoft:~]$ php /downloads/test.php
[root@srv-rhsoft:~]$ cat messages
Dec 11 13:59:11 srv-rhsoft php[23633]: 1        2       3 test

Comment 5 Jiří Vymazal 2017-12-11 13:30:53 UTC
This default behavior comes from backwards compatibility with ancient versions, as you can see it can be overridden, but then you have to live with line-breaks as well. You can see linked upstream issue for discussion how this could be solved, however no conclusion has been reached there so far.

Note You need to log in before you can comment on or make changes to this bug.