<div dir="ltr"><div>Not sure in this specific case - but I parsed some multi-line logs where the lines were not consecutive (i.e. related parts could come in anywhere in the stream) and I had to resort to a program() to handle them. </div><div>I wrote something to identify log messages by key "IDs" and store the data in a hash table until all the parts of the message were received (or a timer expired) and then sent them along to the SIEM.</div><div><br></div><div>Hope that might help.</div><div>Jim</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 10, 2018 at 10:35 AM, Michael Thénault <span dir="ltr"><<a href="mailto:michael.thenault@gmail.com" target="_blank">michael.thenault@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
I have an Issue with syslog-ng 3.16.1 and multi-line logs.<br>
<br>
I try to configure per-application filters using either the program<br>
name or a facility.<br>
The applications use the traditional syslog() from syslog.h.<br>
When an application logs multiple lines, only the first line is filtered.<br>
Indeed, the program name or facility is only applied to the first line.<br>
<br>
Example :<br>
$ logger -t testprog "line1<br>
line2<br>
line3"<br>
<br>
$ cat /var/log/messages<br>
2018-08-10T16:26:14.000000+02:<wbr>00 testprog: line1<br>
2018-08-10T16:26:14.899505+02:<wbr>00 line2<br>
2018-08-10T16:26:14.899505+02:<wbr>00 line3<br>
<br>
The log source is unix-stream("/dev/log" );<br>
<br>
What can I do to fix this ?<br>
<br>
Thanks in advance for your help.<br>
<br>
Thanks & Regards,<br>
Michael<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank" rel="noreferrer">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank" rel="noreferrer">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank" rel="noreferrer">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
</blockquote></div><br></div>