rsyslog - spifno1stsp 作为 rsyslog 属性的真正作用是什么？

Question

我正在阅读 template documentation的 rsyslog为了找到更好的属性，我偶然发现了这个:spifno1stsp - expert options for RFC3164 template processing但是，正如您所看到的，文档非常模糊。此外，我无法在任何地方找到更长的解释。在 Google 上找到的唯一提及总是关于相同的片段或相同的非常简短的描述。
确实，这个属性没有解释:

在 entire rsyslog.com website ,

或在 RFC3164 ,

或其他任何地方。

就像每个人都在这里和那里复制和粘贴相同的片段，但很难理解它实际上在做什么。
任何的想法 ？

Answer 1

把它想象成有点像 if 语句。如果存在空格，请不要执行任何操作。否则，如果没有空格，则添加一个空格。

它有助于确保只在输出中添加一个空格，通常在两个字符串之间。

对于任何此类情况，如果您发现文档可以改进，请随时在官方 GitHub rsyslog documentation project 中提出问题并要求澄清。 .文档团队人手不足，但团队成员会尽可能提供帮助。

如果您正在寻求一般帮助，rsyslog-users mailing list也是很好的资源。多年来，我通过查阅文件和阅读以前的主题学到了很多东西。

回到您关于 spifno1stsp 的问题选项:

虽然您会在该选项上获得一些点击，但您可能会发现更多结果是搜索较旧的字符串模板选项，sp-if-no-1st-sp .以下是您链接到的文档页面中的使用示例:

template(name="forwardFormat" type="string"
         string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
        )

这是此处相关的特定部分:

`%msg:::sp-if-no-1st-sp%%msg%`

来自 Property Replacer文档:

sp-if-no-1st-sp

This option looks scary and should probably not be used by a user. For any field given, it returns either a single space character or no character at all. Field content is never returned. A space is returned if (and only if) the first character of the field’s content is NOT a space. This option is kind of a hack to solve a problem rooted in RFC 3164: 3164 specifies no delimiter between the syslog tag sequence and the actual message text. Almost all implementation in fact delimit the two by a space. As of RFC 3164, this space is part of the message text itself. This leads to a problem when building the message (e.g. when writing to disk or forwarding). Should a delimiting space be included if the message does not start with one? If not, the tag is immediately followed by another non-space character, which can lead some log parsers to misinterpret what is the tag and what the message. The problem finally surfaced when the klog module was restructured and the tag correctly written. It exists with other message sources, too. The solution was the introduction of this special property replacer option. Now, the default template can contain a conditional space, which exists only if the message does not start with one. While this does not solve all issues, it should work good enough in the far majority of all cases. If you read this text and have no idea of what it is talking about - relax: this is a good indication you will never need this option. Simply forget about it ;)

总之， sp-if-no-1st-sp (字符串模板选项)类似于 spifno1stsp (标准模板选项)。

希望有帮助。