<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">The application is custom in-house. I'm really not sure what RFC they've followed. However your suggestion about using 'no-multi-line' seems to have take care of the split lines.<br><br>Thanks,<br>Jo<br><br>--- On <b>Fri, 6/19/09, Balazs Scheidler <i><bazsi@balabit.hu></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>From: Balazs Scheidler <bazsi@balabit.hu><br>Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off<br>To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu><br>Received: Friday, June 19, 2009, 4:38 AM<br><br><div class="plainMail">On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:<br>> We're seeing lines in /var/log/messages that are chopped off. They<br>> should look like
this:<br>> <br>> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header<br>> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""<a ymailto="mailto:info@callcentres.net" href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>"" <<a ymailto="mailto:info@callcentres.net" href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>> ,to=To: ""Graeme Ross"" <<a ymailto="mailto:gross@mobileemail.vodafone.com.au" href="/mc/compose?to=gross@mobileemail.vodafone.com.au">gross@mobileemail.vodafone.com.au</a>>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858"<br>> <br>> But they look like this:<br>> <br>> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header<br>> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""<a
ymailto="mailto:info@callcentres.net" href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>"" <<a ymailto="mailto:info@callcentres.net" href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>> <br>> <br>> <br>> Anyone seen this?<br>> <br>> Thanks<br>> <br>> <br>> <br><br>Well, can you tell us a little bit more on your configuration? What<br>protocol do you use on the source side? Do you happen to use the new<br>RFC5424 style protocol, or the legacy one?<br><br>What is generating those messages, can you show us a tcpdump/strace<br>snippet that shows how that frame is travelling the network?<br><br>Also, syslog-ng 3.0 does not remove embedded NL characters by default,<br>maybe the rest of the message continues on the next line?<br><br>You can reenable the previous behaviour by using the 'no-multi-line'<br>flag for your source or destination (e.g. you can change the multi-line<br>handling not just for
a given source, but also handle the same message<br>differently in different destinations).<br><br>-- <br>Bazsi<br><br><br>______________________________________________________________________________<br>Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br><br></div></blockquote></td></tr></table><br>
<hr size=1>
Looking for the perfect gift?<a href="http://www.flickr.com/gift/"><b> Give the gift of Flickr!</b></a>