Rsyslog by default uses octal codes to encode control codes and whitespace: #012 for newline, #011 for tab

A Google search only turned up results on how to convert octal codes using the standard \012 format rather than #012.

How can I tail a log file and have the newlines and tabs displayed in the output rather than the octal codes that Rsyslog uses?


The following perl one liner will translate the commonly used octal codes to ascii:

tail -f messages.log | perl -pe 's/#(011|012|015)/chr oct $1/ge'

Edit 2019-04-02: modified the regex to target specific octal codes

  • tail -f mysql-error.log | perl -pe 's/#(\d{3})/chr oct $1/ge' will work better if there are any 8-bit characters in that output, and it avoids eval. You said the error logs are from rsyslogd, so I'm not sure why you're tailing mysql's error log. But since you're also the OP I'm going along with it. – Ed Grimm Feb 19 '19 at 4:48
  • @EdGrimm thanks for the suggestion. I've changed the log file name and removed eval. I'll stick with [0-7] as that is the range of valid octal numbers. It'd be nice to have a better regex which won't replace, for example, sequences like #1234 with S4 – IanB Feb 19 '19 at 5:10
  • All of my personal servers are either upgraded to something using journald or using syslog-ng, so I can't check myself: does rsyslogd put something in the log to indicate the difference between a #number and an escape? If there's a character in front of the # to signal that condition, it would be appropriate for our substitution to just remove that character and leave the number unmolested in that case. – Ed Grimm Feb 19 '19 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.