On Mon, Dec 11, 2023 at 03:04:07PM -0600, Goldwyn Rodrigues wrote: > Hi, > > When providing --octet-count with --rfc5424, the message prefixes the > message length on the message. This however comes before priority, and > the syslog message looks like: > > 120 <13>1 2023-12-11T14:22:08.433695-06:00 kora root - rsyslog_dbg [timeQuality tzKnown="1" isSynced="0"] dummy goes to town As described by RFC: https://datatracker.ietf.org/doc/html/rfc6587#section-3.4.1 I think --octet-count makes sense only in situations when used against server that supports it (implements RFC6587 over TCP). The octet count is used as a framing method to separate messages. IMHO it has to be at the beginning. Karel -- Karel Zak <kzak@xxxxxxxxxx> http://karelzak.blogspot.com
