{"action":"created","issue":{"url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/issues/10","repository_url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG","labels_url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/issues/10/comments","events_url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/issues/10/events","html_url":"https://github.com/poshsecurity/Posh-SYSLOG/issues/10","id":276326357,"number":10,"title":"incorrect message format?","user":{"login":"Cris70","id":5107224,"avatar_url":"https://avatars0.githubusercontent.com/u/5107224?v=4","gravatar_id":"","url":"https://api.github.com/users/Cris70","html_url":"https://github.com/Cris70","followers_url":"https://api.github.com/users/Cris70/followers","following_url":"https://api.github.com/users/Cris70/following{/other_user}","gists_url":"https://api.github.com/users/Cris70/gists{/gist_id}","starred_url":"https://api.github.com/users/Cris70/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cris70/subscriptions","organizations_url":"https://api.github.com/users/Cris70/orgs","repos_url":"https://api.github.com/users/Cris70/repos","events_url":"https://api.github.com/users/Cris70/events{/privacy}","received_events_url":"https://api.github.com/users/Cris70/received_events","type":"User","site_admin":false},"labels":[{"id":63314427,"url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":{"login":"kjacobsen","id":2404128,"avatar_url":"https://avatars0.githubusercontent.com/u/2404128?v=4","gravatar_id":"","url":"https://api.github.com/users/kjacobsen","html_url":"https://github.com/kjacobsen","followers_url":"https://api.github.com/users/kjacobsen/followers","following_url":"https://api.github.com/users/kjacobsen/following{/other_user}","gists_url":"https://api.github.com/users/kjacobsen/gists{/gist_id}","starred_url":"https://api.github.com/users/kjacobsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kjacobsen/subscriptions","organizations_url":"https://api.github.com/users/kjacobsen/orgs","repos_url":"https://api.github.com/users/kjacobsen/repos","events_url":"https://api.github.com/users/kjacobsen/events{/privacy}","received_events_url":"https://api.github.com/users/kjacobsen/received_events","type":"User","site_admin":false},"assignees":[{"login":"kjacobsen","id":2404128,"avatar_url":"https://avatars0.githubusercontent.com/u/2404128?v=4","gravatar_id":"","url":"https://api.github.com/users/kjacobsen","html_url":"https://github.com/kjacobsen","followers_url":"https://api.github.com/users/kjacobsen/followers","following_url":"https://api.github.com/users/kjacobsen/following{/other_user}","gists_url":"https://api.github.com/users/kjacobsen/gists{/gist_id}","starred_url":"https://api.github.com/users/kjacobsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kjacobsen/subscriptions","organizations_url":"https://api.github.com/users/kjacobsen/orgs","repos_url":"https://api.github.com/users/kjacobsen/repos","events_url":"https://api.github.com/users/kjacobsen/events{/privacy}","received_events_url":"https://api.github.com/users/kjacobsen/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2017-11-23T10:31:54Z","updated_at":"2017-11-24T08:38:30Z","closed_at":null,"author_association":"NONE","body":"Hi, I have a problem with the message format sent, when using RFC5424 (the default).\r\n\r\nI am directing syslog messages to a CentOS 6 box, which comes with rsyslog v5.8.10.\r\n\r\nLooking at the syslog by using Adiscon LogAnalyzer, it fails to correctly interpret the Syslogtag and ProcessID fields. \r\nIf I look at the raw /var/log/messages file, I see all other messages include a colon after the process id, but not those coming from powershell. If I edit the /var/log/messages file and add a colon after the processid, LogAnalyzer correctly interprets all the fields.\r\n\r\nHere is an excerpt from the file:\r\n```\r\n(...)\r\nNov 20 12:15:48 DVD1SOPENRT1 winbindd[12714]: [2017/11/20 12:15:48.258530,  0] rpc_client/cli_netlogon.c:848(rpccli_netlogon_set_trust_password)\r\n(...)\r\nNov 23 10:00:43 DVD10VDB1 CreaRilascioNew.ps1[804] Errore: Parametri insufficienti.\r\n(...)\r\n```\r\nThe first line is generated by winbindd, the second by powershell.\r\n\r\nI tried to change the format to RFC3164 by adding the -RFC3164 parameter to the Send-SyslogMessage invocation. This works correctly and LogAnalyzer correctly interprets all the fields, but this format lacks the process id information which is quite important to me.\r\n\r\nAny hints?\r\n\r\nThank you in advance\r\nCris"},"comment":{"url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/issues/comments/346772049","html_url":"https://github.com/poshsecurity/Posh-SYSLOG/issues/10#issuecomment-346772049","issue_url":"https://api.github.com/repos/poshsecurity/Posh-SYSLOG/issues/10","id":346772049,"user":{"login":"Cris70","id":5107224,"avatar_url":"https://avatars0.githubusercontent.com/u/5107224?v=4","gravatar_id":"","url":"https://api.github.com/users/Cris70","html_url":"https://github.com/Cris70","followers_url":"https://api.github.com/users/Cris70/followers","following_url":"https://api.github.com/users/Cris70/following{/other_user}","gists_url":"https://api.github.com/users/Cris70/gists{/gist_id}","starred_url":"https://api.github.com/users/Cris70/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cris70/subscriptions","organizations_url":"https://api.github.com/users/Cris70/orgs","repos_url":"https://api.github.com/users/Cris70/repos","events_url":"https://api.github.com/users/Cris70/events{/privacy}","received_events_url":"https://api.github.com/users/Cris70/received_events","type":"User","site_admin":false},"created_at":"2017-11-24T08:38:30Z","updated_at":"2017-11-24T08:38:30Z","author_association":"NONE","body":"@kjacobsen this completely solved my problem!!\r\nTHANK YOU!!"}}
{"actor":{"display_login":"Cris70"}}