What is spifno1stsp really doing as a rsyslog property?

Question

I was reading the template documentation of rsyslog to find better properties and I stumble upon this one:

spifno1stsp - expert options for RFC3164 template processing

However, as you can see, the documentation is quite vague. Moreover, I have not been able to find a longer explanation anywhere. The only mentions found with Google are always about the same snippet or the same very short description.

Indeed, there is no explanation of this property:

• on the entire rsyslog.com website,
• or in the RFC3164,
• or anywhere else actually.

It is like everybody copy & paste the same snippet here and there but it is very difficult to understand what it is actually doing.

Any idea ?

Answer 1

Think of it as somewhat like an if statement. If a space is present, don't do anything. Otherwise, if a space is not present, add a space.

It is useful for ensuring that just one space is added to the output, often between two strings.

For any cases like this that you find where the docs can be improved please feel free to open an issue with a request for clarification in the official GitHub rsyslog documentation project. The documentation team is understaffed, but team members will assist where they can.

If you're looking for general help, the rsyslog-users mailing list is also a good resource. I've learned a lot over the years by going over the archives and reading prior threads.

Back to your question about the spifno1stsp option:

While you will get a few hits on that option, what you'll probably find more results on is searching for the older string template option, sp-if-no-1st-sp. Here is an example of its use from the documentation page you linked to:

template(name="forwardFormat" type="string"
         string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
        )

Here is the specific portion that is relevant here:

`%msg:::sp-if-no-1st-sp%%msg%`

From the Property Replacer documentation:

sp-if-no-1st-sp

This option looks scary and should probably not be used by a user. For any field given, it returns either a single space character or no character at all. Field content is never returned. A space is returned if (and only if) the first character of the field’s content is NOT a space. This option is kind of a hack to solve a problem rooted in RFC 3164: 3164 specifies no delimiter between the syslog tag sequence and the actual message text. Almost all implementation in fact delimit the two by a space. As of RFC 3164, this space is part of the message text itself. This leads to a problem when building the message (e.g. when writing to disk or forwarding). Should a delimiting space be included if the message does not start with one? If not, the tag is immediately followed by another non-space character, which can lead some log parsers to misinterpret what is the tag and what the message. The problem finally surfaced when the klog module was restructured and the tag correctly written. It exists with other message sources, too. The solution was the introduction of this special property replacer option. Now, the default template can contain a conditional space, which exists only if the message does not start with one. While this does not solve all issues, it should work good enough in the far majority of all cases. If you read this text and have no idea of what it is talking about - relax: this is a good indication you will never need this option. Simply forget about it ;)

In short, sp-if-no-1st-sp (string template option) is analogous to spifno1stsp (standard template option).

Hope that helps.