<div class="gmail_quote">On Thu, Sep 1, 2011 at 2:57 PM, <span dir="ltr"><<a href="mailto:mike@lague.org">mike@lague.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
I'm using syslog-ng 3.0.5 (OSE). <br><br>I've noticed that if a multi-line message is sent by an application to syslog-ng via a unix-stream source, the first line is logged to the right destination, and the next line goes to a default destination. E.g., if a message like <br>
"Test message line 1\nTest message line 2\n" <br>is sent,<br>"Test message line 1"<br>appears in the expected destination file, while<br>"Error processing log message: Test message line 2"<br>
appears in the default destination.<br><br>This limitation (which does not exist with unix-dgram sources) seems to have been reported a number of times on various lists.<br><br>The feature comparison table at<br><a href="http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/features/comparison" target="_blank">http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/features/comparison</a><br>
indicates that there is no support for multi-line messages in OSE 3.2, but there is such support in PE 4.0<br><br>Yet I thought a saw a message which indicated that there might be support for multi-line messages in an OSE release? Can someone confirm this? Also, is there any way around this limitation in earlier OSE releases?<br>
<br>Thank you,<br>--Mike<br><br><br><br><br><br><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br>Hey,
<div><br></div><div>/dev/log is an AF_UNIX socket, so you can use unix-dgram in place of unix-stream with no problems (I have in the past for this exact problem). Also, using a UDP (and I imagine TCP) source will preserve newlines.</div>
<div><br></div><div>Regards,</div>