<div dir="ltr">Hi Alain!<div><br></div><div>You can replace unwanted special characters by using rewrite rules is syslog-ng.</div><div><a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/rewrite-replace.html" target="_blank">https://www.balabit.com/<wbr>documents/syslog-ng-ose-<wbr>latest-guides/en/syslog-ng-<wbr>ose-guide-admin/html/rewrite-<wbr>replace.html</a><br></div><div>Rewrite rules accept regular expressions as search pattern.</div><div>Please check regular expression options (e.g. use global flags to replace all instances).</div><div>Example:</div><div><div> rewrite{ subst("\r", " ", flags("global")); };</div></div><div><br></div><div><a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/regular-expressions.html">https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/regular-expressions.html</a><br></div><div><br></div><div>Best regards,</div><div>Gabor</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 4, 2017 at 3:33 PM, <span dir="ltr"><<a href="mailto:alain.villefranque@orange.com" target="_blank">alain.villefranque@orange.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="FR" link="blue" vlink="purple">
<div class="m_-179760404452666137WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">Hi all,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">I have an issue with the character Carriage Return (^M) inserted by the Syslog source machine.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">I try to substitute or rewrite this special character with syslog-ng relay, but it is impossible to modify it, it seems this char is invisible for
the program.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">I’ve tried to modified it with either with ^M or 0xD char with no success.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">Example of received message:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">Dec 4 13:35:23 conf01 2017-12-04 13:35:23,561 Level="INFO" Name="support.sip" Message="Sending SIP response" Src-address="80.12.yy.xx" Src-port="5061"
Dst-address="161.105.yy.xx" Dst-port="38509" Transport="TLS" <u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">Detail<b>="^M</b>SIP/2.0 403 Forbidden<b>^M</b>Via: SIP/2.0/TLS 161.105.150.12:38509;alias;<wbr>branch=z9hG4bK.MEgSOM8O4;<wbr>rport=38509;received=161.105.<wbr>150.12<b>^M</b>From:
<sip:SondeSQS_001!@<a href="http://int.ovp.orange-business.com" target="_blank">int.ovp.<wbr>orange-business.com</a>>;tag=<wbr>5kYhVMAyi^MTo: sip:SondeSQS_001!@<a href="http://int.ovp.orange-business.com" target="_blank">int.ovp.<wbr>orange-business.com</a>;tag=<wbr>aynkBKUjt0pXHzNv<b>^M</b>CSeq: 25 REGISTER<b>^M</b>Call-ID: Vhihsb~BhQ<b>^M</b>Allow: INVITE,ACK,OPTIONS,CANCEL,BYE,<wbr>REGISTER,INFO,SUBSCRIBE,<wbr>NOTIFY,MESSAGE<b>^M</b>Supported:
categoryList,adhoclist,sdp-<wbr>anat,replaces^MContent-Length: 0<b>^M^M</b>"<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">I’d like to suppress
<b>^M</b> or replace it with a “space” char.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">Is there any specific action to do in order to modify ^M special character ?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif"">Regards
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif"">Alain<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height:15.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""> <u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<pre>______________________________<wbr>______________________________<wbr>______________________________<wbr>______________________________<wbr>_
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</pre></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>