Quagga log will not be able to log to /var/log/quagga

[richard28530]

#1810 Prefix docker container name to syslog syslogtag (program name)

after this modification log of bgp docker looks like below

Jul 26 15:45:40.888666 S9130-Core INFO bgp/bgpd[62]: %ADJCHANGE: neighbor 10.10.118.25(S9130-Leaf-Right) in vrf Default Up
Jul 26 15:45:40.889960 S9130-Core INFO bgp/bgpd[62]: %ADJCHANGE: neighbor 10.10.116.25(S9130-Leaf-Left) in vrf Default Up
Jul 26 15:45:40.890904 S9130-Core INFO bgp/bgpd[62]: %ADJCHANGE: neighbor 10.10.119.25(S9130-Leaf-Right) in vrf Default Up
Jul 26 15:45:40.894264 S9130-Core INFO bgp/bgpd[62]: %ADJCHANGE: neighbor 10.10.117.25(S9130-Leaf-Left) in vrf Default Up

Quagga log aggregate by specify the $programname, but the programname can not contain certain character.

cat /etc/rsyslog.d/00-sonic.conf
## Quagga rules

if $programname == ["quagga",
                    "watchquagga",
                    "zebra"]
    then {
    /var/log/quagga/zebra.log
    stop
}

if $programname == "bgpd" then {
    /var/log/quagga/bgpd.log
    stop
}

programname
the “static” part of the tag, as defined by BSD syslogd. For example, when TAG is “named[12345]”, programname is “named”.

Precisely, the programname is terminated by either (whichever occurs first):

end of tag
nonprintable character
‘:’
‘[‘
‘/’
The above definition has been taken from the FreeBSD syslogd sources.

Please note that some applications include slashes in the static part of the tag, e.g. “app/foo[1234]”. In this case, programname is “app”. If they store an absolute path name like in “/app/foo[1234]”, programname will become empty (“”). If you need to actually store slashes as part of the programname, you can use the global option

global(parser.permitSlashInProgramName=”on”)

to permit this. Then, a syslogtag of “/app/foo[1234]” will result in programname being “/app/foo”. Note: this option is available starting at rsyslogd version 8.25.0.

[lguohan]

instead of using '/', maybe we can use #

like bgp#bgpd

[lguohan]

@richard28530, thanks a lot for report. please check the #1918

[lguohan]

thanks for reporting.