<div dir="ltr"><div>Hi Balazs,<br><br></div>what is your thought about my config? did you see?<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jul 8, 2013 at 12:30 PM, Satish Patel <span dir="ltr">&lt;<a href="mailto:satish.txt@gmail.com" target="_blank">satish.txt@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">This is what i have configured and no luck with it.. can you suggest what i am missing? <br><br>destination d02_tc74_log { file(&quot;/logs/server1/tomcat7.4/catalina_$YEAR$MONTH$DAY.log&quot; template(&quot;$(indent-multi-line ${MESSAGE})\n&quot;) template(t_tomcatlog) owner(&quot;root&quot;) group(&quot;root&quot;) perm(0644) dir_perm(0755) create_dirs(yes)); };<br>

filter server1 { host(&quot;<a href="http://server1.example.com" target="_blank">server1.example.com</a>&quot;) };<br>log {<br>  source (s_tomcat);<br>  filter (server1);<br>  filter (tomcat7_4);<br>  destination (d02_tc74_log);<br>
};<br>
<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jul 8, 2013 at 12:08 PM, Satish Patel <span dir="ltr">&lt;<a href="mailto:satish.txt@gmail.com" target="_blank">satish.txt@gmail.com</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">How do i use indented-multi-line ? I meant where do i configure it? I tried but my syslog-ng doesn&#39;t recognizing this option i have syslog-ng 3.3.7  could you give me example where and how do i check whether it is supported or not <br>


</div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Jul 6, 2013 at 2:12 AM, Balazs Scheidler <span dir="ltr">&lt;<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>&gt;</span> wrote:<br>


<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">This looks.like the format that should be supported by indented-multi-line</p><div><div>

<div class="gmail_quote">On Jul 5, 2013 9:33 PM, &quot;Satish Patel&quot; &lt;<a href="mailto:satish.txt@gmail.com" target="_blank">satish.txt@gmail.com</a>&gt; wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">



<div dir="ltr">Here is my tomcat catalina.out log file sample. See there is a tab space in logs<br><br>2013-06-27 05:30:00,065 [EDISN-Scheduler_Worker-2] ERROR com.example.edisn.sftp.SftpSession - Exception attempting to work with an SFTP Session: connection is closed by foreign host<br>




2013-06-27 05:30:00,066 [EDISN-Scheduler_Worker-2] ERROR org.quartz.core.JobRunShell - Job EDISN.CTMS_Upload threw an unhandled Exception:<br>com.example.edisn.EdisnRuntimeException: Exception attempting to work with an SFTP Session: connection is closed by foreign host<br>




        at com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:64)<br>        at com.example.edisn.EdisnSession.exec(EdisnSession.java:13)<br>        at com.example.ctms.CtmsScheduledJob.executeInternal(CtmsScheduledJob.java:27)<br>




        at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86)<br>        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)<br>        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:525)<br>




Caused by: com.jcraft.jsch.JSchException: connection is closed by foreign host<br>        at com.jcraft.jsch.Session.connect(Unknown Source)<br>        at com.jcraft.jsch.Session.connect(Unknown Source)<br>        at com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:45)<br>




        ... 5 more<br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jul 5, 2013 at 3:27 PM, Balazs Scheidler <span dir="ltr">&lt;<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>&gt;</span> wrote:<br>




<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">No, I implemented a different multiline style support first (that is not in pe), where continuation lines are indicated by indentation, like mime.</p>





<p dir="ltr">Iirc tomcat has this kind of log file. Can you show a sample log entry?</p>
<p dir="ltr">The infrastructure for multiline-prefix is also there but not added yet.</p>
<p dir="ltr">Let me see the sample, I&#39;ll tell if the current solution works or not.</p><div><div>
<div class="gmail_quote">On Jul 5, 2013 8:24 PM, &quot;Satish Patel&quot; &lt;<a href="mailto:satish.txt@gmail.com" target="_blank">satish.txt@gmail.com</a>&gt; wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">





<div dir="ltr"><div>Thanks for reply Balazs,<br><br></div>You mean say this feature is available in Open Source Edition (OSE) 3.4? Once after specifying flag &quot;indented-multi-line&quot; i can use multi-line-prefix? <br>






</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jul 5, 2013 at 1:26 PM, Balazs Scheidler <span dir="ltr">&lt;<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>&gt;</span> wrote:<br>






<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">You have found the PE documentation but I have already ported this to the OSE tree and has been released as part of 3.4.</p>







<p dir="ltr">You have to specify indented-multi-line as a flag to the file source.</p>
<div class="gmail_quote"><div>On Jul 5, 2013 6:28 PM, &quot;Satish Patel&quot; &lt;<a href="mailto:satish.txt@gmail.com" target="_blank">satish.txt@gmail.com</a>&gt; wrote:<br type="attribution"></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">






<div>
<div dir="ltr"><div>We have tomcat shop and at everyone know tomcat has a java call trace in logs with tab space but syslog-ng doesn&#39;t know about it and printing lines as a new line. I have read here syslog-ng 3.x does support multi-line logs <a href="http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guides/en/syslog-ng-pe-v4.0-guide-admin-en/html/reference_source_syslog.html" target="_blank">http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guides/en/syslog-ng-pe-v4.0-guide-admin-en/html/reference_source_syslog.html</a><br>








<br></div>But does this feature available in Open Source syslog-ng? If yes then why its not working for me? <br></div>
<br></div>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>
</div></div><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>
</div></div><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>