Opened 6 years ago

Closed 6 years ago

Last modified 5 years ago

#667 closed enhancement (fixed)

_ (underscore) is not allow for syslog tag

Reported by: Ke Zhang Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.7.x
Keywords: syslog log Cc:
uname -a: Linux ***.***.*** 3.2.0-70-virtual #105-Ubuntu SMP Wed Sep 24 20:06:46 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.7.7
built by gcc 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5)
TLS SNI support enabled
configure arguments: --prefix=/opt/nginx --with-http_ssl_module --with-http_gzip_static_module --with-http_stub_status_module --with-cc-opt=-Wno-error --add-module=/opt/rubies/ruby-2.1.2/lib/ruby/gems/2.1.0/gems/passenger-4.0.53/ext/nginx

Description

When running 'nginx -t', nginx complains:

[emerg] syslog "tag" only allows alphanumeric characters

The only non-alphanumeric character in the tag is '_'. We have '_' in every other syslog streams, and our rsyslog filters relies on this character.

Change History (6)

comment:1 by Vladimir Homutov <vl@…>, 6 years ago

In 68f64bc17fa4d09392c624850e0ed5d3e3025ec4/nginx:

Syslog: allowed underscore symbol in tag (ticket #667).

comment:2 by vl, 6 years ago

Resolution: fixed
Status: newclosed
Type: defectenhancement

comment:3 by vl, 6 years ago

Since the underscore is a commonly used thing in real life, I agree with the proposal.

But note that RFC 3164 explicitly states that "Any non-alphanumeric character will terminate the
TAG field and will be assumed to be the starting character of the CONTENT field".

comment:4 by Ke Zhang, 6 years ago

Thanks @vl, I didn't expect it to be this quick. Look forward to the next version.

I'm not sure about other implementation of syslog, but rsyslog supports this.

comment:5 by Greg Karékinian, 5 years ago

What about dots?

We currently have a lot of Graylog2 extractors that depend on tags that include dots (because of filenames like "appname.access.log"). I didn't know the RFC, we are still using remote_syslog to send some logs to a syslog server (it uses the filename as a tag).

Thanks in advance.

comment:6 by vl, 5 years ago

I do not see any connection between filenames and syslog tags.
It is up to the receiving side to choose a method to store received information in files
and if it is willing to include tag into filename, it should be able to do so without any
modifications to nginx configuration.

Note: See TracTickets for help on using tickets.