This is one example:<div><br></div><div> [parser/msg_parser.c:714]: ERROR: parse_msg: message=<SIP/2.0</div><div>CSeq:713601 INVITE</div><div>Via: SIP/2.0/UDP192.168.1.1;branch=z9hG4bKd3a2.99b5ab56.0;received=192.168.1.1<br>
<div><br></div><div>Rsyslog replaces the \n with the string #015#012 so i keep my message in one line</div><div><br></div><div> [parser/msg_parser.c:714]: ERROR: parse_msg: message=<SIP/2.0
#015#012CSeq:713601 INVITE#015#012Via:
SIP/2.0/UDP192.168.1.1;branch=z9hG4bKd3a2.99b5ab56.0;received=192.168.1.1<br>
<br>But syslog-ng only stores the first line of the message<br>[parser/msg_parser.c:714]: ERROR: parse_msg: message=<SIP/2.0 </div><div><br></div><div>Regards,</div><div><br></div><div>Daniel </div><div><br><div class="gmail_quote">
2012/10/25 Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@balabit.hu" target="_blank">algernon@balabit.hu</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">Balazs Scheidler <<a href="mailto:bazsi77@gmail.com">bazsi77@gmail.com</a>> writes:<br>
<br>
>> I have one question, does syslog-ng OSE support multiline parsing logs?<br>
>> i have one applications that send multiline messages and syslog-ng save<br>
>> the log of the first line only.<br>
><br>
</div><div class="im">> syslog-ng core is multiline aware, however a transport is needed that<br>
> supports multiline messages.<br>
><br>
> such a transport is udp(), which has other issues. syslog() with<br>
> either udp, tcp or tls supports multiline messages.<br>
><br>
> similarly unix-dgram should work for locally generated multiline<br>
> messages.<br>
><br>
> the only missing thing is the ability to read local files and<br>
> recognize multiline barriers, but Algernon is working on solving this.<br>
<br>
</div>It is progressing nicely, and it will be available in syslog-ng 3.4 if<br>
all goes well. I already have indented-multiline support in a state I'm<br>
reasonably happy with[1], a more flexible solution will be implemented<br>
once a few other pending issues are resolved.<br>
<br>
[1]: <a href="https://github.com/algernon/syslog-ng/tree/feature/3.4/indented-multiline" target="_blank">https://github.com/algernon/syslog-ng/tree/feature/3.4/indented-multiline</a><br>
<br>
Meanwhile, I'd like to ask what kind of multiline logs does your<br>
application produce? Can you show a sample, by any chance? That'd help<br>
me make sure that the multiline reader I'm working on will work for all<br>
kinds of use-cases.<br>
<br>
Thanks in advance!<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
|8]<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</font></span></blockquote></div><br></div></div>