syslog - What field does the Docker tag relate to in RFC 5424 -
my docker syslog tags being truncated @ seems 32 characters. when @ rfc 5424 not sure field is. know? trying verify allowed length tag can be.
apr 19 06:43:05 ord-nodecore-prd-01 docker/core_sql_event_processor_ha[1207]: 2016-04-19t06:43:05.265z [sqleventhandler] event '3c5e1a15-f8a1-4bfa-b2fa-2e54b2a5fbaa' resulted in 0 relevant application events
becomes:
<30>apr 19 06:43:05 ord-nodecore-prd-01 docker/core_sql_event_processor_ 2016-04-19t06:43:05.265z [sqleventhandler] event '3c5e1a15-f8a1-4bfa-b2fa-2e54b2a5fbaa' resulted in 0 relevant application events
note tag, docker/core_sql_event_processor_ha[1207]:
here rfc link: https://tools.ietf.org/html/rfc5424#page-9
i thinking 'sd-name' may 'app-name'. no idea.
your example has nothing rfc5424, , looks more rfc3164 (which not standard, collection of older best practices). please read this: https://tools.ietf.org/html/rfc5424#appendix-a.1 search 'tag ' - in essence, rfc5424 not have tag field such.
i not familiar docker logging, if read https://docs.docker.com/engine/admin/logging/overview/#syslog-options , check syslog-format
- seems format can specified, rfc5424micro
recommend, seems in case not configured that.
Comments
Post a Comment