Hi,

Adding a NUL via the template is difficult as the template compiler works with zero terminated string, and even though the lexer allows the use of \x0, this will indicate the end-of-the-string like you have seen it.

Adding a zero byte would be possible by writing a template function $(format-gelf) and that probably could sit within the json module, reusing the infrastructure there.

On the other hand, I've checked the GELF specification, and I can't see the NUL byte being required.

http://graylog2.org/gelf#specs

Are you sure this is the issue?

Bazsi

On Thu, Aug 7, 2014 at 11:09 AM, Nicolas Fédou <nicolas.fedou@gmail.com> wrote:

Hello,
I need to send a null character at the end of a message on a tcp output...
But this null is considered to be an end of string.

My use case is sending a GELF message to a graylog's tcp input.
GELF message is a json syntax quite simple to comply with thanks to format-json.
Graylog needs a null character at the end of a GELF message in TCP but not in UDP.

I tried many combination in the template with \x0, echo \x0, `global_definition_of_null`, etc...
The matter is that null character when interpreted is an end of string, and is not written in the tcp message.
I see truncated messages with ngrep.
Like "a\x0b" gives "a" according to ngrep.

I did not find any option to actually write a null character.
Do you have any options ?

As Graylog already have clients and librairies I belive they won't remove the need for a null character.
Shall I open an issue on syslog-ng to ask for an option in templates or in format-json ?

Regards, Nicolas Fédou.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

--
Bazsi

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq