[syslog-ng] file source driver questions

[Balazs Scheidler]

On Thu, 2009-02-12 at 11:53 -0500, Michael Hocke wrote:

> - By default all messages coming from the file source driver are  
> tagged with the kern facility. I was not able to find this in the  
> documentation but the source code (cfg-grammar.y) revealed that the  
> file driver accepts the options "facility()" and "level()" to change  
> this behavior.
> 
> source s_accounting { file ("/opt/CSCOar/logs/accounting.log"  
> follow_freq (1) program_override ("radius") flags (no-parse)
>                        facility (local7)); };

True enough, it should be added there.


> - Empty lines seem to be ignored and not transmitted. The entries:
> 
> "La la
> blah blah
> 
> Hi There
> good-bye"
> 
> end up as
> 
> "La la
> blah blah
> Hi There
> good-bye"
> 
> in my log file on the server side. Is there a way to enable that?

this is intentional right now, empty lines are ignored. it is not very
difficult to add support for this, so I've just implemented it:

commit 41f77f536a4e442d8dd2e0b6276987c07ac09b45
Author: Balazs Scheidler <bazsi at balabit.hu>
Date:   Sun Feb 15 09:46:35 2009 +0100

    [logreader] implement 'empty-lines' flag
    
    This new flag allows the transmission of zero-length messages.

You can find it in the git repository, or tomorrow's daily snapshot. You
can use it by specifying flags(empty-lines) to the source reading your
log file.

-- 
Bazsi