<div dir="ltr">It works! Thank You for explaination.</div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><p><span lang="EN-US" style="font-family:Verdana,sans-serif;color:rgb(136,136,136)">-- <br></span><b><span lang="EN-US" style="font-size:13.5pt;font-family:Verdana,sans-serif;color:black">Jacek Drewniak</span></b><span lang="EN-US" style="font-family:Verdana,sans-serif;color:black"><br></span><font color="#000000" face="Verdana, sans-serif">R&D</font></p><p style="margin:0cm 0cm 0.0001pt;background-image:initial;background-repeat:initial"><b><span lang="PL" style="font-size:10pt;font-family:Verdana,sans-serif">email</span></b><span lang="PL" style="font-size:10pt;font-family:Verdana,sans-serif">: </span><span style="font-size:10pt;font-family:Verdana,sans-serif"><a href="mailto:jacek.drewniak@oort.in" target="_blank"><font color="#000000">jacek.drewniak@oort.in</font></a></span><span lang="PL" style="font-size:10pt;font-family:Arial,sans-serif"></span></p><p style="margin:0cm 0cm 0.0001pt;background-image:initial;background-repeat:initial"><b><span lang="PL" style="font-size:10pt;font-family:Verdana,sans-serif;color:black">mobile</span></b><span lang="PL" style="font-size:10pt;font-family:Verdana,sans-serif;color:black">: <u>+</u></span><span lang="PL" style="font-size:10pt;font-family:Verdana,sans-serif"><font color="#000000"><u>48 696 151 670</u></font></span><span lang="PL" style="font-size:10pt;font-family:Arial,sans-serif"></span></p><p style="margin:0cm 0cm 0.0001pt;background-image:initial;background-repeat:initial"></p><p style="margin:0cm 0cm 0.0001pt;background-image:initial;background-repeat:initial"><b><span style="font-size:10pt;font-family:Verdana,sans-serif;color:black">website</span></b><span style="font-size:10pt;font-family:Verdana,sans-serif"><font color="#000000">:</font><span style="color:black"> </span><a href="http://www.oort.in/" style="color:rgb(17,85,204)" target="_blank"><font color="#000000">www.oort.in</font></a></span><span style="font-size:10pt;font-family:Arial,sans-serif"></span></p><p style="margin:0cm 0cm 0.0001pt;background-image:initial;background-repeat:initial"><br></p><p><span lang="EN-US" style="font-family:Verdana,sans-serif;color:black"><img src="http://www.oort.in/oort-stuff/logo-mail2.png"><br></span></p><p><span style="color:rgb(153,153,153);font-family:verdana,sans-serif"><br></span></p><p><span style="color:rgb(153,153,153);font-family:verdana,sans-serif">AWARDS</span><br></p><p></p><p></p><p></p><p style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255)"><font face="verdana, sans-serif"><span style="color:rgb(153,153,153)">Bluetooth Breakthrough Award Finalist</span><br><span style="color:rgb(153,153,153)">CES 2015 </span><span style="color:rgb(153,153,153)">Envisioneering</span><i style="color:rgb(153,153,153)"> </i><span style="color:rgb(153,153,153)">Innovation & Design Award Winner</span><br><span style="color:rgb(153,153,153)">Tech Trailblazers Awards Winner</span><br><span style="color:rgb(153,153,153)">Most exciting company at Bluetooth Media Event in New York 2014</span><br><span style="color:rgb(153,153,153)">Polish Agency for Enterprise Development Award Winner</span></font><br></p></div></div></div></div></div>
<br><div class="gmail_quote">2015-08-17 11:10 GMT+02:00 PÁSZTOR György <span dir="ltr"><<a href="mailto:pasztor@linux.gyakg.u-szeged.hu" target="_blank">pasztor@linux.gyakg.u-szeged.hu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<span class=""><br>
"Jacek Drewniak" <<a href="mailto:jacek.drewniak@oort.in">jacek.drewniak@oort.in</a>> írta 2015-08-14 15:44-kor:<br>
> Thanks for advises.<br>
><br>
> Now my configs:<br>
> <a href="http://pastebin.com/G6S2YV6S" rel="noreferrer" target="_blank">http://pastebin.com/G6S2YV6S</a><br>
> <a href="http://pastebin.com/wCVc2hqH" rel="noreferrer" target="_blank">http://pastebin.com/wCVc2hqH</a><br>
<br>
</span>As far as I see, you put the flags(syslog-protocol) to the wrong place.<br>
In the "syslog()" source (even if it's tls), you do not have to specify<br>
that it is syslog-protocol, since that is the defaults.<br>
flags(syslog-protocol) is needed only, when you do not have framing.<br>
But since it's tls, and the other side is a syslog-ng too, It is not needed<br>
to define flags(syslog-protocol) there too.<br>
Where you need the flags(syslog-protocol) is the file() source, since if<br>
you do not define otherwise, the default is that every line is a new<br>
message. That's why the complete line appears as the "$MESSAGE" part.<br>
<br>
So suggested changes:<br>
* s_hub1 & s_hub2: add flags(syslog-protocol)<br>
* d_tls: remove flags(syslog-protocol)<br>
* s_tls: remove flags(syslog-protocol)<br>
<span class=""><br>
> Sending log: <a href="http://pastebin.com/Euhp1Lmz" rel="noreferrer" target="_blank">http://pastebin.com/Euhp1Lmz</a><br>
> Now its is parsed: <a href="http://pastebin.com/x46pk4FF" rel="noreferrer" target="_blank">http://pastebin.com/x46pk4FF</a><br>
> So this didn't help.<br>
<br>
</span>See above!<br>
<span class=""><br>
> Yes, "[TIMER]" part is also part of the message.<br>
><br>
> @Gyu I don't understand this part about length of message . Do You have<br>
> link to documentation?<br>
<br>
</span>The format/ protocol specification is not part of the syslog-documentation.<br>
Since it's a protocol, they are defined in RFCs. The ietf syslog protocol<br>
itself is defined in RFC5424, and the transport related things, eg. the<br>
framing is defined in RFC5425 and RFC5426.<br>
However, the new information, which was not clear for me, for the first<br>
sight: You want to receive ietf syslog protocol from files.<br>
<br>
One important notice: Since the source are files, and you want to receive<br>
syslog-protocol from them, but framing is not possible to define this way,<br>
you can not have multi-line messages / values in the sdata fields, since<br>
one line is one message. On udp: One packet is one message, and on tcp/tls<br>
you can have framing (unless you disable it explicitly by defining<br>
flags(syslog-protocol) ), as I already referenced the related RFCs about<br>
that.<br>
<div class="HOEnZb"><div class="h5"><br>
Cheers,<br>
Gyu<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div>