On Thu, 2009-02-12 at 11:53 -0500, Michael Hocke wrote:
- By default all messages coming from the file source driver are tagged with the kern facility. I was not able to find this in the documentation but the source code (cfg-grammar.y) revealed that the file driver accepts the options "facility()" and "level()" to change this behavior.
source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse) facility (local7)); };
True enough, it should be added there.
- Empty lines seem to be ignored and not transmitted. The entries:
"La la blah blah
Hi There good-bye"
end up as
"La la blah blah Hi There good-bye"
in my log file on the server side. Is there a way to enable that?
this is intentional right now, empty lines are ignored. it is not very difficult to add support for this, so I've just implemented it: commit 41f77f536a4e442d8dd2e0b6276987c07ac09b45 Author: Balazs Scheidler <bazsi@balabit.hu> Date: Sun Feb 15 09:46:35 2009 +0100 [logreader] implement 'empty-lines' flag This new flag allows the transmission of zero-length messages. You can find it in the git repository, or tomorrow's daily snapshot. You can use it by specifying flags(empty-lines) to the source reading your log file. -- Bazsi