backslash and expansion variable quirk in line log format string

10 Apr 2015


      Hi Everyone,
I am doing some radius sysloging via the linelog module for accounting requests which is working well except for a string format quirk - my module config is below. I'm trying to get the logged message to be in the format of foo\<username> where foo is only relevant to the device reading the syslog messages and is not a radius login realm.  However, foo\\%{User-Name} results in a logged message of "foo\%{User-name}" instead of "foo\fred" - the \% is being interpreted as a control code. If there is any character between the '\' and the '%' it works correctly and logs "foo\fred". Is there any string format configuration that will result in 'foo\fred' being logged  - using %{User-Name} - without an  inserted space/char in the middle ? I don't seem to be able to find a format that works.

ie
%{User-Name} is "fred"
"foo\\%{User-Name}",  logs "foo\%{User-Name}" to syslog
"foo\\ %{User-Name}"  - space between '\' and '%' - logs "foo\ fred" to syslog, with a space in the string

Module config:
linelog SyslogAccountingtoPaloAlto {
	filename = "syslog"
	format = "This is a log message for %{User-Name}"
	reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
	Access-Request = "Requested access: %{User-Name}"
	Access-Reject = "Rejected access: %{User-Name}"
	Access-Challenge = "Sent challenge: %{User-Name}"
	foo {
	    bar = "Example log.  Please ignore"
	}

	Accounting-Request {

		Start = "Radius Acct Start: Username:%{User-Name}"
                	Stop = "Radius Acct Stop: Username:%{User-Name}"
                	Interim-Update = "Radius Interim-Update: Username:foo\\%{User-Name}"

		#  Don't log anything for these packets.
		Alive = ""

		Accounting-On = ""
		Accounting-Off = ""

		# don't log anything for other Acct-Status-Types.
		unknown = ""
        }
}

Thanks heaps

Jason Rankin