Why when applying Props.conf, HF suddenly stops?

[ivan5593]

Hello all,

We are using an RSyslog to write logs to file in a Heavy Forwarder but we found that it was escaping tabs as #011. We found a solution that is apply to the file source a SEDCMD as follows:

inputs.conf

[monitor:///opt/splunk-data/<datafile>]
sourcetype=<datasource>

 props.conf

[source::///opt/splunk-data/<datafile>]
SEDCMD-fix_tab = s/#011/	/g

We applied the configuration and restarted the HF and worked by about 15 minutes but then suddenly stopped to change this character by a tab. Why can this happen?

Thank you!

[isoutamo]

Hi

what you are meaning with "suddenly stopped to change this character by a tab" ? Are those come again as #011 or what?

Have you several HFs which are collecting those events and send those to splunk? Or several places where you are collecting those from one HF?

Is there any way that you can change rsyslog's option EscapeControlCharactersOnReceive off to avoid that coding on rsyslog side?

There are also other escape character what it's converting and also you should remember that 8 times space is not exactly the same than <tab>!

r. Ismo