<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#0050d0" bgcolor="#ffffff">
Sent: Wed Aug 24 2011 10:49:29 GMT-0600 (MST)<br>
From: <a class="moz-txt-link-abbreviated" href="mailto:bugzilla@bugzilla.balabit.com">bugzilla@bugzilla.balabit.com</a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] [Bug 131] New: XML tags being stripped
<blockquote cite="mid:bug-131-3@https.bugzilla.balabit.com%2F"
type="cite">
<pre wrap=""><a class="moz-txt-link-freetext" href="https://bugzilla.balabit.com/show_bug.cgi?id=131">https://bugzilla.balabit.com/show_bug.cgi?id=131</a>
Summary: XML tags being stripped
Product: syslog-ng
Version: 3.0.x
Platform: All
OS/Version: Linux
Status: NEW
Severity: normal
Priority: unspecified
Component: syslog-ng
AssignedTo: <a class="moz-txt-link-abbreviated" href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>
ReportedBy: <a class="moz-txt-link-abbreviated" href="mailto:jsu2@emory.edu">jsu2@emory.edu</a>
Type of the Report: bug
Estimated Hours: 0.0
Is there a known bug where syslog-ng arbitrarily strips xml tags from log messages? That is, some of our logs output xml, and syslog-ng seems to be stripping
some of these tags before writing them. In particular, we have syslog-ng client configured to read from a local log file, send the log file to the syslog-ng
server. The server does some basic csv parsing before writing it out. If this problem is fixed in a newer version, please let me know which version.
Here's what the original log file should look like:
2011-08-24 12:00:02,685 INFO [Thread-35674] - [MessageIdentificationSyncCommand] Processing message <?xml version="1.0" encoding="UTF-8"?>
<PurchaseOrderMessage version="2.2">
<Header>
<MessageId>3125206c-5063-4465-a020-0131fc850885</MessageId>
</pre>
</blockquote>
<SNIP><br>
<blockquote cite="mid:bug-131-3@https.bugzilla.balabit.com%2F"
type="cite">
<pre wrap="">
But, it shows up on syslog-ng server as:
intesbprod1 [10857]: Error processing log message: <PurchaseOrderMessage version="2.2">
intesbprod1 :
intesbprod1 :
intesbprod1 : 00:02.183-04:00</Timestamp>
intesbprod1 :
intesbprod1 :
</pre>
</blockquote>
<br>
This isnt a bug. Your log file is in an invalid format. All of the
message must be on a single line, syslog-ng treats each line of the
input file as a separate message. Think about it this way, suppose
your XML had "2011-08-24 12:00:02,685 INFO" right in the middle of
it on a new line, how would syslog-ng be able to tell the difference
between a new log entry and this text in the middle of the log?<br>
Basically the only way to fix this would be to have whatever is
writing out the log file strip out all newlines.<br>
</body>
</html>