[Boost-users] Syslog Message Field

Subject: [Boost-users] Syslog Message Field
From: Michael Peters (mike101a_at_[hidden])
Date: 2015-03-10 22:51:11

        (
            expr::format("syslog.exe: %1%: %2%")
                % expr::attr< unsigned int >("RecordID")
                % expr::smessage
        );

        // We'll have to map our custom levels to the syslog levels
        sinks::syslog::custom_severity_mapping< severity_levels > mapping("Severity");
        mapping[normal] = sinks::syslog::info;
        mapping[warning] = sinks::syslog::warning;
        mapping[error] = sinks::syslog::critical;

        sink->locked_backend()->set_severity_mapper(mapping);

        // Set the remote address to sent syslog messages to
        sink->locked_backend()->set_target_address("localhost");

        // Add the sink to the core
        logging::core::get()->add_sink(sink);

        // Add some attributes too
        logging::core::get()->add_global_attribute("RecordID", attrs::counter< unsigned int >());

        // Do some logging
        src::severity_logger< severity_levels > lg(keywords::severity = normal);
        BOOST_LOG_SEV(lg, normal) << "A syslog record with normal level";
        BOOST_LOG_SEV(lg, warning) << "A syslog record with warning level";
        BOOST_LOG_SEV(lg, error) << "A syslog record with error level";
 

For some reason the Timestamp and Source machine name is
being added to the start of Message field. 
So the syslog message field looks something like this: 

    Mar 10 23:23:47 pluto syslog.exe:
0: A syslog record with normal level 

When I would expect the message field to look like this: 

    syslog.exe: 0: A syslog record
with normal level 

I have tested with both Kiwi Syslog and Syslog Watcher
software for Windows on different PC’s running different OS’s and both behave
in the same way.  All other devices that
log to the Syslog server correctly format the message field.

 



Is there a hidden attribute (source machine name and timestamp) that I am not aware of that is
being added to the message text?

Is the Syslog server software perhaps receiving what it considers to be an incorrectly formatted message and is therefore corrupting the message field?

Any suggestions  / thoughts on what to check would be appreciated.

 

Mike