Rsyslog: What's the difference between msg and rawmsg?

[yfliuyanyan]

Expected behavior

What's the difference between msg and rawmsg? It seems they are the same. But when I use TCP to transfer data, the rawmsg has content, msg is empty. Why?

Environment

• rsyslog version: 8.36
• platform:
• for configuration questions/issues, include rsyslog.conf and included config files

[rgerhards]

rawmsg is the message as it is received from the network. It has the syslog header, e.g. timestamp and tag. msg is just the syslog payload (the MSG field from RFC3164 and RFC5424). If your senders are RFC-compliant, both should differ.

[yfliuyanyan]

Got it. Thank you very much!

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.