2104
rsyslog notes

match & execute

rsyslog 7.4.10

$template sample, "%msg%\n"
if $msg contains "Error connecting via IPC socket to log: Connection refused" then ^/usr/local/bin/dans_reload;sample

rsyslog 5.8.10

:msg, contains, "Error connecting via IPC socket to log: Connection refused" ^/usr/local/bin/dans_reload

Notes on rsyslog 7.4.10

# rsyslogd -v
rsyslogd 7.4.10

EscapeControlCharactersOnReceive

global variable on /etc/rsyslog.conf

$EscapeControlCharactersOnReceive off

the main problem is that converts TAB to #011