<div dir="ltr"><div><div><div>Hi Evan!<br><br></div>Unfortunately only PE supports multiline timeout as of now, but we hope that this feature will make it to 3.6 OSE. As for the second question, I submitted a pull request which introduces regexp-suffix multiline mode, it does roughly the same that you mentioned. You can check it here: <a href="https://github.com/balabit/syslog-ng/pull/120">https://github.com/balabit/syslog-ng/pull/120</a>.<br>
<br></div>Hope I could help,<br></div>Viktor<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Apr 22, 2014 at 9:30 PM, Evan Rempel <span dir="ltr"><<a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
I am having two problems with the multi-line-mode (I am using a pipe source for testing).<br>
<br>
<br>
1. The last message written to the pipe will not be processed until the start (multi-line-prefix matches)<br>
of the next message is received. This makes messages delay until the next message arrives.<br>
<br>
2. The last message the is written to the pipe is lost if syslog-ng is reloaded or restarted.<br>
<br>
<br>
<br>
Is there an option for how long to wait for the "full" message to arrive?<br>
Is there an option to specify what the "LAST" line of the mutli-line message should match?<br>
That way the message is known to be completed.<br>
<br>
Thanks for your time.<br>
<br>
Evan.<br>
<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><br></div>