# Rsyslogd and Characters #012 and #015

In the context of `rsyslogd`, `#012` and `#015` are hexadecimal representations of ASCII control characters:

- **`#012`**: This represents the Line Feed (LF) character, often denoted as `\\n` in many programming languages. It is used to indicate the end of a line and the start of a new one.
- **`#015`**: This represents the Carriage Return (CR) character, denoted as `\\r`. It returns the cursor to the beginning of the line without advancing to the next line.

### Handling Line Endings in `rsyslog`

Different systems or applications may use different conventions for line endings:

- **Unix/Linux systems** typically use LF (`#012`) as the line terminator.
- **Windows systems** use a combination of CR and LF (`#015#012`) to indicate the end of a line.

### Configuring `rsyslog` for Different Line Endings

When dealing with log files that might have mixed or unusual line endings, you might need to process or normalize them. Here’s how you can handle this with `rsyslog`:

1. **Preprocessing Logs**: If log files are coming from different sources with mixed line endings, you might need to preprocess these logs to standardize line endings. You can use tools like `dos2unix` or `unix2dos` for conversion before `rsyslog` processes the logs.
    
    ```bash
    dos2unix /path/to/logfile.log
    ```
    
2. **Configuring Log Parsing**: If `rsyslog` is not correctly parsing log files due to unexpected line endings, you might need to adjust configurations or preprocess logs. For example, you might need to handle multiline logs manually if they are not correctly delimited.
3. **Custom Parsing Rules**: You can write custom parsing rules or use scripts to clean up or convert logs before they are processed by `rsyslog`.
4. **Testing and Debugging**: Use the `rsyslog` debugging options to see how logs are being processed and identify any issues with line endings.
    
    ```bash
    sudo rsyslogd -d
    ```
    

### Example: Handling Mixed Line Endings

If you have a log file with mixed line endings and want to process it with `rsyslog`, you might use a preprocessing step to normalize line endings. For example:

```bash
# Convert all CRLF line endings to LF
sed -i 's/\\r$//' /path/to/logfile.log
```

Then configure `rsyslog` to handle the normalized log file:

```
module(load="imfile") # Load the imfile module

input(type="imfile"
      File="/path/to/logfile.log"
      Tag="myapp"
      Ruleset="processLogs")

ruleset(name="processLogs") {
    action(type="omfile" File="/var/log/processed.log")
}

```

### Conclusion

Handling `#012` (LF) and `#015` (CR) characters in `rsyslog` involves ensuring that log files have consistent line endings or preprocessing them to standardize their format.