Browse code

Add NILVALUE for STRUCTURED-DATA in RFC5424 logs

RFC 5424 (https://tools.ietf.org/html/rfc5424#section-6.2) requires that
STRUCTURED-DATA be present, either as NILVALUE (-) or as one or more
SD-ELEMENT items. Because Docker doesn't ever create any SD-ELEMENT items,
the format should output the NILVALUE instead. This resolves parsing issues
in various RFC 5424-compliant syslog servers.

Signed-off-by: Mark Parker <godefroi@gmail.com>

Mark Parker authored on 2017/02/03 07:16:14
Showing 1 changed files
... ...
@@ -68,7 +68,7 @@ func init() {
68 68
 func rfc5424formatterWithAppNameAsTag(p syslog.Priority, hostname, tag, content string) string {
69 69
 	timestamp := time.Now().Format(time.RFC3339)
70 70
 	pid := os.Getpid()
71
-	msg := fmt.Sprintf("<%d>%d %s %s %s %d %s %s",
71
+	msg := fmt.Sprintf("<%d>%d %s %s %s %d %s - %s",
72 72
 		p, 1, timestamp, hostname, tag, pid, tag, content)
73 73
 	return msg
74 74
 }
... ...
@@ -79,7 +79,7 @@ func rfc5424formatterWithAppNameAsTag(p syslog.Priority, hostname, tag, content
79 79
 func rfc5424microformatterWithAppNameAsTag(p syslog.Priority, hostname, tag, content string) string {
80 80
 	timestamp := time.Now().Format("2006-01-02T15:04:05.999999Z07:00")
81 81
 	pid := os.Getpid()
82
-	msg := fmt.Sprintf("<%d>%d %s %s %s %d %s %s",
82
+	msg := fmt.Sprintf("<%d>%d %s %s %s %d %s - %s",
83 83
 		p, 1, timestamp, hostname, tag, pid, tag, content)
84 84
 	return msg
85 85
 }