[LOG4J2-2630] Syslog PatternParser always escapes backslash

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 2.11.2
• Component/s: Appenders, Pattern Converters

Environment

Java 1.8

Log4J 2.11.2

• Assignee: Unassigned
• Reporter: Nicolás Rossi
• Created: 13/Jun/19 18:15
• Updated: 13/Jun/19 18:16

Description

The KeyValuePair in the SyslogAppender always escapes the backslash even if you don't use it as escape character. It is forced on the PatternParser.java:177 (last parameter). 

Steps to reproduce:

1. Configure the KeyValuePair to read the ThreadContext variable "eventName":

 

<Syslog name="SyslogAudit" format="RFC5424" host="10.1.2.55" port="1468"
           protocol="TCP" appName="test" includeMDC="false" mdcId="test"                      
           facility="USER" enterpriseNumber="18060" newLine="true"  
           messageId="Audit">
   <LoggerFields>
       <KeyValuePair key="evt" value="%X{eventName}"/> 
   </LoggerFields>
</Syslog>

1. Set a ThreadLocal with a String with a backslash (here it is escaped because I'm inside Java) and then send a message:

ThreadContext.put("eventName", "Attribute with backslash: [\\]");
log.debug("Hello world!");

 

The message received is:

06-13-2019 14:52:50 User.Debug 10.1.2.54 1 2019-06-13T14:52:51.298-03:00 MacBook-Pro.local test 62462 Audit [test@18060 evt="Attribute with backslash: [
]"] Hello World!