RFC5424 support?

[l29ah]

metalog seems to ignore syslog messages sent to /dev/log that satisfy the RFC.

Is there a doc on what kind of syntax does metalog actually expect?

[m-kress]

Do you have an example, what syslog message sent to /dev/log gets ignored?

The only doc regarding the syntax seems to be the code. What exactly is the issue?

[l29ah]

My real issue is haskell-hvr/hslogger#17 (that is also not-RFC5424 tho).
I don't have an example at hand rn.

[m-kress]

It would be very helpful having an example that works with syslog-ng and not with metalog.
In metalog.c that line might get eliminated in parseLogLine()

[l29ah]

Built an example from that issue report, it yields this in strace: [pid 5717] sendto(16, "<11>: [/ERROR] This won't show up with metalog.\0", 48, 0, NULL, 0) = 48.

[m-kress]

It seems as metalog expects a ":" after the [xyz], e.g.
<11>: [/ERROR]: This might show up with metalog

Obviously metalog has been loosely written for RFC3164 (BSD syslog).

[l29ah]

Adding a ":" doesn't change the behavior it seems.

[m-kress]

You could test again with ": " (space after colon).
Metalog works like described in RFC3164, not like the predecessor RFC5424. Please also look at the other issue #32