- syslog-ng - lists.balabit.hu

getting "Error processing log message" for checkpoint logs
by Russell Fulton 20 May '20

20 May '20

I am trying to ingest logs from a checkpoint firewall over a tcp connection: source s_checkpoint { network( transport("tcp") flags(no-multi-line) port(2514) keep-alive(yes) flags(syslog-protocol) ); }; # added flags(syslog-protocol) on suggest of checkpoint docs for syslog-ng destination d_debug { file( "/data/russell//test.log" ); }; log { source( s_checkpoint ); destination( d_debug ); }; This is what turns up in the output: May 18 12:10:42 secmgrprd02 syslog-ng[1555]: Error processing log message: <134>1 2020-05-17T23:33:27Z smartlog01 CheckPoint 25651 -….. Any ideas on what is going on or how to find out? Russell

2 5

How to get the number of logged message count
by Monitto Pitchaimani sebastin (mopitcha) 18 May '20

18 May '20

Hi All, Is there a way to get the logged messages to the particular destination? We wanted to get the count of number of logs delivered to the particular destination I.e., network() etc Regards, Monitto

2 1

Insider 2020-05: syslog-ng 3.27; Python HTTP header; DBLD; Sumologic;
by Peter Czanik (pczanik) 14 May '20

14 May '20

Dear syslog-ng users, This is the 81st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.27 of syslog-ng released ---------------------------------- Version 3.27.1 of syslog-ng is now available, adding many smaller features to syslog-ng. These include new macros to check where a given log message arrived, a new rewrite to easily change the syslog facility of a message, a Sumologic destination and an experimental feature to check log integrity. For source code and full details, check https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1 For ready-to-use packages check https://syslog-ng.com/3rd-party-binaries Introduction to the Python HTTP header -------------------------------------- You can create your own custom headers for the HTTP destination using syslog-ng’s Python HTTP header plugin and Python scripts. The included example configuration only adds a simple counter to the headers, but with a bit of coding, you can resolve authentication problems or fine-tune how data is handled at cloud-based logging and SIEM platforms, like Sumologic. https://www.syslog-ng.com/community/b/blog/posts/introduction-to-the-python… DBLD: a syslog-ng developer tool not just for developers -------------------------------------------------------- DBLD is a central tool when it comes to syslog-ng development, but even after multiple blogs about the tool, it is still not much used outside of the developers’ team. So, what is DBLD and how could it be used even by you? The abbreviation stands for Docker BuiLD. Using containers ensures both that you have an easily reproducible build environment, and also that you do not have to “pollute” your base system with development-related software packages. You can use DBLD to build the release tarball or ready-to-use packages for a number of Linux distributions. It can even be used as a development environment with all necessary tools installed. Still not convinced? Yes, the listed possibilities are mostly interesting for syslog-ng developers and 3rd party packagers. If you are lucky, you will never need DBLD. On the other hand, it can come handy if you reported a problem and the syslog-ng team fixed it. Even if you are not a developer, only a junior sysadmin, you can still easily build fixed syslog-ng packages for testing (and even for production use) until an official release with the fix arrives. https://www.syslog-ng.com/community/b/blog/posts/dbld-a-syslog-ng-developer… Getting your logs into Sumo Logic with syslog-ng made easy ---------------------------------------------------------- Sumo Logic is one of the most popular cloud-based log management and security analytics services. They provide their own log shippers, but also work with others, including syslog-ng. The use of syslog-ng is well documented on their support website, but the actual configuration part can easily be simplified. A new, dedicated Sumo Logic destination is already available as part of syslog-ng 3.27. It is based either on the network() or the http() destination of syslog-ng and implemented as an SCL, hiding away most of the configuration details from the users. https://www.syslog-ng.com/community/b/blog/posts/getting-your-logs-into-sum… syslog-ng PE 7.0.20 available ----------------------------- Version 7.0.20 of syslog-ng Premium Edition was released. It adds Red Hat Enterprise Linux 8 to the supported platforms: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… Using RHEL 8 instead of RHEL 7 you can use udp-balancer() source for high performance UDP log collection: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… NEW WHITE PAPERS * Upgrade to State-of-the-Art Log Management: https://www.syslog-ng.com/whitepaper/log-management-essentials8137754/ WEBINARS * Learn how to easily integrate Azure Sentinel into your log-data strategy: https://www.syslog-ng.com/webcast-ondemand/learn-how-to-easily-integrate-az… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Missing one log message when destination unavailable for short period of time.
by Ali Shirvani 08 May '20

08 May '20

Hi all, I tried to setup simple relay with syslog-ng, it receives log on one port and forward to the destination. It works fine when destination is available, but when destination unavailable for a short period of time and then became available I miss one log entry. For example assume that I send simple numbers with logger command to syslog-ng, from 0 to 100, when I receive 50 on destination I stop its listener and start it again, in this case the first log entry that I receive is 52 instead of 51. Here is my syslog-ng.conf: @version: 3.26 options { time_reopen(5); }; source s_network { network( ip("127.0.0.1") port(514) transport("udp") ); }; destination d_network { network( "127.0.0.1" port(5514) transport("udp") ); }; log { source(s_network); destination(d_network); }; Would you please help me to resolve this issue? Regards, Ali

3 6

Syslogs not writing to disk
by Rose, Ed 05 May '20

05 May '20

Hello All, I have syslog-ng setup currently setup to write to disk and forward events on to a different syslog server. Syslog isn't writing to disk it seems. I do not see any errors either, unless I am not looking in the right place for the errors. Tcpdump -v host x.x.x.x shows data coming in from the host but a tail -f ${HOST}/log_${HOST} shows no logs going to disk. Thanks Ed syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: afmongodb,sdjournal,linux-kmsg-format,appmodel,date,pseudofile,afamqp,syslogformat,csvparser,cef,tags-parser,affile,afsocket,afstomp,tfgetent,json-plugin,confgen,system-source,stardate,graphite,dbparser,afprog,xml,add-contextual-data,snmptrapd-parser,cryptofuncs,kvformat,disk-buffer,basicfuncs,afuser,map-value-pairs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on filter f_awanra1 { host("x.x.x.x"); }; filter f_bwanra1 { host("x.x.x.x"); }; filter f_cwanra1 { host("x.x.x.x"); }; destination d_ciscoasa { file("/var/log2/gns/cisco_asa/${HOST}/log_${HOST}" create-dirs(yes) dir-perm(0755) dir-group(splunk) perm(0640) group(splunk)); }; destination d_uid1 { tcp("x.x.x.x" port(514) ); }; destination d_uid2 { tcp("x.x.x.x" port(514) ); }; destination d_uid3 { tcp("x.x.x.x" port(514) ); }; destination d_uid4 { tcp("x.x.x.x" port(514) ); }; log { source(s_net); filter(f_amywanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_cnswanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_demwanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); };

2 8

syslog-ng 3.27 Debian/Ubuntu packages (OBS)
by Laszlo Budai 30 Apr '20

30 Apr '20

Hi, syslog-ng 3.27.1[1] packages are available in OBS repositories[2, 3]. List of supported OSs: * Debian 9.0 * Debian 10.0 * Raspbian 9.0 * Raspbian 10.0 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 * Ubuntu 19.04 * Ubuntu 19.10 * Ubuntu 20.04 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.27.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

syslog-ng 3.27
by Laszlo Budai 30 Apr '20

30 Apr '20

3.27.1 Highlights * DESTIP/DESTPORT/PROTO: new macros. (#2899<https://github.com/syslog-ng/syslog-ng/pull/2899>) * set-facility(): add new rewrite operation to change the syslog facility associated with the message. (#3136<https://github.com/syslog-ng/syslog-ng/pull/3136>) * network tls: Added ca-file() option. With this option the user can set a bundled CA-file to verify the peer. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * Forward integrity and confidentiality of logs (#3121<https://github.com/syslog-ng/syslog-ng/pull/3121>): It is an experimental feature currently, we are still working on the final form with the authors. Features * DESTIP/DESTPORT/PROTO: new macros These new macros express the destination ip, destination port and used protocol on a source. The use-case behind the PR is as follows: * someone has an appliance which sends out log messages via both UDP and TCP * the format of the two are different, and he wants to capture either with the simplest possible filter * netmask() doesn't work because the IP addresses are the same * host() doesn't work because the hostnames are the same Example: log { source { network(localip(10.12.15.215) port(5555) transport(udp)); }; destination { file("/dev/stdout" template("destip=$DESTIP destport=$DESTPORT proto=$PROTO\n")); }; }; Output: destip=10.12.15.215 destport=5555 proto=17 (#2899<https://github.com/syslog-ng/syslog-ng/pull/2899>) * set-facility(): add new rewrite operation to change the syslog facility associated with the message. log { source { system(); }; if (program("postfix")) { rewrite { set-facility("mail"); }; }; destination { file("/var/log/mail.log"); }; flags(flow-control); }; (#3136<https://github.com/syslog-ng/syslog-ng/pull/3136>) * network tls: Added ca-file() option. With this option the user can set a bundled CA-file to verify the peer. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * http: When a HTTP response is received, emit a signal with the HTTP response code. (Later it can be extended to read the response and parse it in a slot...). This PR also extends the Python HTTP header module with the possibility of writing custom HTTP response code handlers. When someone implements an auth header plugin in Python, it could be useful (for example invalidating a cache). Example config, click to expand! (#3159<https://github.com/syslog-ng/syslog-ng/pull/3159>) * java/python: add support for the "arrow" syntax. options("key" => "value") (#3161<https://github.com/syslog-ng/syslog-ng/pull/3161>) (#3247<https://github.com/syslog-ng/syslog-ng/pull/3247>) * python: persist support for python This feature enables users to persist data between reloads or restarts. The intended usage is to support bookmarking and acknowledgement in the future. It is not suitable for local database use cases. (#3171<https://github.com/syslog-ng/syslog-ng/pull/3171>) * rewrite: Added conditional set-tag() option. With this option the user can put condition statement inside set-tag option. rewrite { set-tag("tag" condition(match("test" value("MSG")))); }; (#3190<https://github.com/syslog-ng/syslog-ng/pull/3190>) * scl: add sumologic destinations: sumologic-syslog() and sumologic-http() (#3194<https://github.com/syslog-ng/syslog-ng/pull/3194>) * iterate: new template function The iterate template function generates a series from an initial number and a next function. For example you can generate a sequence of nonnegative numbers with source { example-msg-generator( num(3) template("$(iterate $(+ 1 $_) 0)") ); }; (#3205<https://github.com/syslog-ng/syslog-ng/pull/3205>) * telegram: new max-size option Telegram message will be truncated for max-size size. Telegram does not accept message larger than 4096 utf8 characters. The default value is 4096. (#3206<https://github.com/syslog-ng/syslog-ng/pull/3206>) * example-message-generator : add support for values(name1 => value1, name2 => value2,..) syntax. Example @version: 3.27 log { source { example-msg-generator(template("message parameter") num(10) values("PROGRAM" => "program-name" "current-second" => "$C_SEC" )); }; destination { file(/dev/stdout template("$(format-json --scope all-nv-pairs)\n")); }; }; (#3237<https://github.com/syslog-ng/syslog-ng/pull/3237>) * example-msg-generator: support freq(0) for fast message generation log { source { example-msg-generator(freq(0) num(100)); }; destination { file("/dev/stdout"); }; }; (#3245<https://github.com/syslog-ng/syslog-ng/pull/3245>) Bugfixes * file: changed time-reap() timer's schedule to respect the documentation (expires after last message) (#3133<https://github.com/syslog-ng/syslog-ng/pull/3133>) * dbld: fix building problems * fix rpm package build on centos-7 * fix devshell image build * fix ubuntu-trusty image build * fix deb package build on ubuntu-trusty * fix rpm package build on fedora-30 (#3143<https://github.com/syslog-ng/syslog-ng/pull/3143>) * tls (network): Properly log an error message, when key-file() or cert-file() is missing. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * loggen: fix crash with invalid parameterization (#3146<https://github.com/syslog-ng/syslog-ng/pull/3146>) * format-json: fix printing of embedded zeros Prior to 2.64.1, g_utf8_get_char_validated() in glib falsely identified embedded zeros as valid utf8 characters. As a result, format json printed the embedded zeroes as \u0000 instead of \x00. This change fixes this problem. (#3175<https://github.com/syslog-ng/syslog-ng/pull/3175>) * configure: fix --with-net-snmp configure option (#3180<https://github.com/syslog-ng/syslog-ng/pull/3180>) * python: fix Py_None reference counting in logger methods (trace, debug, info, warning, error) (#3187<https://github.com/syslog-ng/syslog-ng/pull/3187>) * afmongodb: do not build module when ENABLE_MONGODB=OFF (#3188<https://github.com/syslog-ng/syslog-ng/pull/3188>) * telegram: automatically truncate messages larger than 4096 utf8 characters to avoid telegram destination to get stuck (#3206<https://github.com/syslog-ng/syslog-ng/pull/3206>) * compat/glib: fix recursive call issue on CentOS-6/RHEL-6/platforms (#3212<https://github.com/syslog-ng/syslog-ng/pull/3212>) * timeutils: fix crash in %f conversion when non-numeric character is in usec field (e.g. ".asd123") (#3270<https://github.com/syslog-ng/syslog-ng/pull/3270>) Packaging * macOS: add example startup configuration. (#3172<https://github.com/syslog-ng/syslog-ng/pull/3172>) * rpm: fix --without maxminddb option If maxminddb development package was installed on the build system: rpmbuild fails if --without maxminddb was used. (#3208<https://github.com/syslog-ng/syslog-ng/pull/3208>) Notes to developers * light: Support to relocate reports dir other than current base dir For example python -m pytest -lvs functional_tests/source_drivers/file_source/test_acceptance.py --installdir=/install --reports /tmp/ (#3157<https://github.com/syslog-ng/syslog-ng/pull/3157>) * CONTRIBUTING.md: contribution guide updated (#3174<https://github.com/syslog-ng/syslog-ng/pull/3174>) * libtest: Now we install config_parse_lib.h, fake-time.h, mock-cfg-parser.h and queue_utils_lib.h which help unit testing outside of core. (#3179<https://github.com/syslog-ng/syslog-ng/pull/3179>) * tests: Wait until snmptrapd process able to write traps into output file (#3185<https://github.com/syslog-ng/syslog-ng/pull/3185>) * mongodb: Replaced the deprecated get_server_status() API with command_simple(). This means, that syslog-ng can now be built with -Werror on systems with 1.15 libmongoc. (#3199<https://github.com/syslog-ng/syslog-ng/pull/3199>) * stats: add external stats counters There are situations when someone wants to expose internal variables through stats-api. Without this changeset, we need two distinct variables: one is for the internal state, other is for the stats registration (internal state cannot depends on the life cycle of the StatsCounterGroup). (#3225<https://github.com/syslog-ng/syslog-ng/pull/3225>) Other changes * afsnmp: merge two existing SNMP modules (trapd-parser and destination) into one. Motivation: keep closely related modules together and decrease the number of small packages. Packaging related changes: libsnmptrapd-parser.so has been removed, both the snmp destination and the trapd parser are part of afsnmp.so . * deb: we already had mod-snmp which shipped snmp-dest. From now, this packages installs the snmptrapd-parser syslog-ng module. The syslog-ng-mod-snmptrapd-parser package has been removed. * rpm: snmpdest renamed to afsnmp and the snmptrapd-parser is installed by this package from now (#3142<https://github.com/syslog-ng/syslog-ng/pull/3142>) * dbld: remove ubuntu-cosmic as it has reached EOL (#3143<https://github.com/syslog-ng/syslog-ng/pull/3143>) * afsocket-source: present the number of connections in stats It helps in the debug process if we can see the number of source connections counted by syslog-ng internally. (#3193<https://github.com/syslog-ng/syslog-ng/pull/3193>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Airbus Commercial Aircraft, Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Kokan, Laszlo Budai, Laszlo Szemere, László Várady, Mehul Prajapati, Roberto Meléndez, Stephan Marwedel, Steven Haigh, Peter Czanik, Thomas De Schampheleire, Vatsal Sisodiya, Vivin Peris https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1

1 0

Issue with processing syslog event
by Raghunath Adhyapak 29 Apr '20

29 Apr '20

Hello all, I am receiving the following syslog line from one of devices. <134>1 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 Mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 This line contains a version filed immediately following the priority, and then timestamp is in epoch format as against ISO8601 or other standard format. I see the following error in syslog-ng log: [2020-04-28T10:46:15.340911] Outgoing message; message='Apr 28 10:46:15 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53' What could be the possible issue here? My config is as follows: ##======================================== ######################## # Global options ######################## options {keep_hostname (yes); use_dns (no); mark-freq(30);}; ######################## # Sources ######################## source s_syslog { syslog( transport(udp) port(514) max-connections(500) ); }; ######################## # Destinations ######################## destination d_file { file("/var/log/dump.log"); }; ######################## # Log paths ######################## log { source(s_syslog); destination(d_file); flags(flow-control); }; ##======================================== If I check my file /var/log/dump.log, I see that the error line is getting written to it too. root@ip-172-31-240-95:~# tail -f /var/log/dump.log | grep "Error processing" Apr 28 10:44:46 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 Apr 28 10:46:15 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 Thanks Raghu

3 5

Syslog-ng network namespace support
by Monitto Pitchaimani sebastin (mopitcha) 28 Apr '20

28 Apr '20

Hi All, Does syslog-ng supports log forwarding to remote host in different network namespaces? Regards, Monitto

3 5

Re: [syslog-ng] syslog-ng, json and handle escaping properly
by Arthur Lambert 27 Apr '20

27 Apr '20

> log { > source { example-msg-generator(num(1) template("{\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Check pstore partition..\"}")); }; > parser { json-parser(); }; > destination { file(/dev/stdout template("$(format-json --key category,level,message timestamp=${ISODATE})\n")); }; >}; Ok so first I update the syslog-ng config file with your modification diff --git a/board/xxx/xxx/rootfs/etc/syslog-ng.conf b/board/xxx/xxx/rootfs/etc/syslog-ng.conf index c28ea5e59d..6b93ce24b8 100644 --- a/board/xxx/xxx/rootfs/etc/syslog-ng.conf +++ b/board/xxxx/xxx/rootfs/etc/syslog-ng.conf @@ -4,10 +4,6 @@ filter f_middleware { facility("local1"); }; -template t_json_filetemplate { - template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n"); -}; source s_kernel { file("/proc/kmsg" program_override("kernel")); }; @@ -21,7 +17,8 @@ destination d_kernel { }; destination d_middleware { - file("/data/logs/middleware.log", template(t_json_filetemplate)); + file(/data/logs/middleware.log template("$(format-json --key category,level,message timestamp=${ISODATE})\n"));; + }; log { @@ -31,6 +28,7 @@ log { log { source(s_middleware); + parser { json-parser(); }; filter(f_middleware); destination(d_middleware); }; I also add the '{' in my macro log diff --git a/log/log_private.h b/log/log_private.h index b1e2dd31..09e875e1 100644 --- a/log/log_private.h +++ b/log/log_private.h @@ -18,7 +18,7 @@ #define _PRINT_DEBUG(M, ...) \ do { \ - syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ + syslog(LOG_DEBUG, "{\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ } while (0) #else @@ -28,32 +28,32 @@ #define _PRINT_INF_GOTO(M, ...) \ do { \ - syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"INFO\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ + syslog(LOG_DEBUG, "{\"category\":\"%s\",\"level\":\"INFO\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ errno = 0; \ goto error; \ (...) #endif /* !LOG_PRIVATE_H_ */ So basically I suppose that your modification allows to syslog-ng to understand by itself that there is an extra pair key/value in my format and that I am using JSON format. So let's do some test now... int main (void) { PRINT_DEBUG ("Test simple."); PRINT_DEBUG ("\nTest with return line\n."); PRINT_DEBUG ("Test with json inside message : {\"key\" : \"%d\", \"key2\" : \"%d\"} ", 42, 21); PRINT_DEBUG ("Test simple2."); PRINT_DEBUG ("Begin. Program name : %s", argv[0]); (...) } Result : # cat /data/logs/middleware.log {"timestamp":"2020-04-24T15:36:28+02:00","message":"Test simple.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Test simple2.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Begin. Program name : nano_core","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Board config : nano_proto1","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Initialize GPIO..","level":"INFO","category":"GPIO_MANAGER"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Synchronize dictionnary with current rootfs content","level":"INFO","category":"AUDIO_MANAGER"} As you can see, the line with \n and the JSON debug output is not in the final log. It was not in a good format for the JSON syslog-ng parser. How can I fix that? Now that syslog-ng is able to understand that there is a category, a level, a message in my JSON. I cannot just ask for syslog-ng to use the escape template only on the column with message key before sending the message to the parser? I am able to fix the \n issue by using unix-dgram instead of unix-stream but without really understand why. New result after using unix-dgram : {"timestamp":"2020-04-24T15:58:09+02:00","message":"Test simple.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"\nTest with return line\n.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"Test simple2.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"Begin. Program name : nano_core","level":"DEBUG","category":"MPU_CORE"}

2 1