Thanks for the suggestions Jim & Lance. I'm running CentOS 5 using the default logger. I did try what Lance suggested: restarting syslog-ng w/ log_msg_size set to 65K in the options section (both the client and server). However, echo'ing a 8192 character string to logger resulted in several fragments. Guess it's on to Jim's suggestion...<div>
<br><div class="gmail_quote">On Fri, Feb 5, 2010 at 3:00 AM, <span dir="ltr"><<a href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Send syslog-ng mailing list submissions to<br>
<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:syslog-ng-owner@lists.balabit.hu">syslog-ng-owner@lists.balabit.hu</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of syslog-ng digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: config file question (Rory Toma)<br>
2. Apache + syslog-ng w/o logger? (Brian Donaldson)<br>
3. Re: Apache + syslog-ng w/o logger? (Jim Hendrick)<br>
4. Re: Apache + syslog-ng w/o logger? (Lance Laursen)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Thu, 04 Feb 2010 16:52:52 -0800<br>
From: Rory Toma <<a href="mailto:rory@ooma.com">rory@ooma.com</a>><br>
Subject: Re: [syslog-ng] config file question<br>
To: Zolt?n Pallagi <<a href="mailto:pzolee@balabit.hu">pzolee@balabit.hu</a>><br>
Cc: Syslog-ng users' and developers' mailing list<br>
<<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
Message-ID: <<a href="mailto:4B6B6BE4.30109@ooma.com">4B6B6BE4.30109@ooma.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
On 2/2/10 4:49 AM, Zolt?n Pallagi wrote:<br>
> Hi Rory,<br>
><br>
> Will you tell me the current naming of your log files? I don't know<br>
> the real reason for many log files, but as Robert said, perhaps, there<br>
> are another easier solutions to avoid it.<br>
><br>
We maintain one log file per client per day, in directory buckets of<br>
2000 clients.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100204/f3d5ca02/attachment-0001.htm" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100204/f3d5ca02/attachment-0001.htm</a><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 4 Feb 2010 17:00:39 -0800<br>
From: Brian Donaldson <<a href="mailto:briantd@gmail.com">briantd@gmail.com</a>><br>
Subject: [syslog-ng] Apache + syslog-ng w/o logger?<br>
To: <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
Message-ID:<br>
<<a href="mailto:9f5bff671002041700l5b1d5153kd315cc428ed58ab0@mail.gmail.com">9f5bff671002041700l5b1d5153kd315cc428ed58ab0@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
My goal is to enable Apache to log large access_log entries (> 1024 chars)<br>
to a syslog-ng server. The vast majority of examples I've seen for<br>
connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but<br>
that approach chops up messages longer than 1024 chars. The alternative<br>
approach is to use a perl/python script, but I'm nervous about the overhead.<br>
Anyone know of an updated logger binary?<br>
<br>
Thanks for any pointers,<br>
-Brian<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100204/20dc3677/attachment-0001.htm" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100204/20dc3677/attachment-0001.htm</a><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 4 Feb 2010 20:23:43 -0500<br>
From: "Jim Hendrick" <<a href="mailto:jrhendri@maine.rr.com">jrhendri@maine.rr.com</a>><br>
Subject: Re: [syslog-ng] Apache + syslog-ng w/o logger?<br>
To: "'Syslog-ng users' and developers' mailing list'"<br>
<<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
Message-ID: <<a href="mailto:FB.84.23327.E137B6B4@hrndva-omtalb.mail.rr.com">FB.84.23327.E137B6B4@hrndva-omtalb.mail.rr.com</a>><br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
Would using syslog-ng directly work? (pointing it at the access_log file)<br>
<br>
Jim<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a><br>
[mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Brian Donaldson<br>
Sent: Thursday, February 04, 2010 8:01 PM<br>
To: <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
Subject: [syslog-ng] Apache + syslog-ng w/o logger?<br>
<br>
My goal is to enable Apache to log large access_log entries (> 1024 chars)<br>
to a syslog-ng server. The vast majority of examples I've seen for<br>
connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but<br>
that approach chops up messages longer than 1024 chars. The alternative<br>
approach is to use a perl/python script, but I'm nervous about the overhead.<br>
Anyone know of an updated logger binary?<br>
<br>
Thanks for any pointers,<br>
-Brian<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Thu, 4 Feb 2010 17:28:03 -0800<br>
From: Lance Laursen <<a href="mailto:lance@demonware.net">lance@demonware.net</a>><br>
Subject: Re: [syslog-ng] Apache + syslog-ng w/o logger?<br>
To: "Syslog-ng users' and developers' mailing list"<br>
<<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
Message-ID:<br>
<<a href="mailto:ffa53b891002041728nd8cc926x952b170ac8a9bf23@mail.gmail.com">ffa53b891002041728nd8cc926x952b170ac8a9bf23@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Hello,<br>
<br>
After changing the log_msg_size(65536); parameter in syslog-ng.conf's<br>
options {}; section, I've used logger to send a single message with a 64KB<br>
payload. Have you tried using logger yet to see if it does what you need?<br>
I've just tested this on ubuntu 8.04, the logger binary being part of the<br>
default installed bsdutils package 1:2.14.2-1ubuntu4. Keep in mind regular<br>
syslogd has a 1024KB limit and all messages passed through it first will get<br>
chopped.<br>
<br>
You can also do what Jim suggests and use a "file" sourcetype on your<br>
access_log and go from there.<br>
<br>
-Lance<br>
<br>
<br>
On Thu, Feb 4, 2010 at 5:00 PM, Brian Donaldson <<a href="mailto:briantd@gmail.com">briantd@gmail.com</a>> wrote:<br>
<br>
> My goal is to enable Apache to log large access_log entries (> 1024 chars)<br>
> to a syslog-ng server. The vast majority of examples I've seen for<br>
> connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but<br>
> that approach chops up messages longer than 1024 chars. The alternative<br>
> approach is to use a perl/python script, but I'm nervous about the overhead.<br>
> Anyone know of an updated logger binary?<br>
><br>
> Thanks for any pointers,<br>
> -Brian<br>
><br>
> ______________________________________________________________________<br>
> This email has been scanned by the MessageLabs Email Security System.<br>
> For more information please visit <a href="http://www.messagelabs.com/email" target="_blank">http://www.messagelabs.com/email</a><br>
> ______________________________________________________________________<br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation:<br>
> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
><br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100204/aa1c1901/attachment-0001.htm" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100204/aa1c1901/attachment-0001.htm</a><br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
<br>
<br>
End of syslog-ng Digest, Vol 58, Issue 5<br>
****************************************<br>
</blockquote></div><br></div>