Hi all@syslog-ng-mailing-list!

 

I’m trying to monitor the MSSQLServer ERROR-logfile but

I get a logentry for every single letter that is added to the logfile:

 

->

May 18 13:57:40 test mssql: L
May 18 13:57:40 test mssql: o
May 18 13:57:40 test mssql: g
May 18 13:57:40 test mssql: i
May 18 13:57:40 test mssql: n
May 18 13:57:40 test mssql:  
May 18 13:57:40 test mssql: f
May 18 13:57:40 test mssql: a
May 18 13:57:40 test mssql: i
May 18 13:57:40 test mssql: l
May 18 13:57:40 test mssql: e
May 18 13:57:40 test mssql: d
<-

 

This seems to stem from the encoding of the file (UTF-16LE) because

with other logfiles this problem doesn’t arise.

I suppose it would help if the “encoding”-Parameter of the file-source would work

but syslog-ng/cygwin (Version 3.0.1) won’t start when I add it no matter which encoding I use.

 

I tried this workaround-cronjob:

-       copy file somewhere

-       convert to UTF-8 using iconv

-       give the same timestamp to the converted logfile

so that syslog-ng doesn’t transfer the whole file again

-       monitoring the converted file with syslog-ng

This doesn’t work completely correct as despite assigning the same timestamp

the whole file is sometimes transferred again (and not just the new

entries).

 

Is this problem (following this UTF-16LE-Windowsfile (easily))

not resolvable by using the cygwin-version of syslog-ng??

Or am I maybe using a wrong encoding spelling?

Does it work using the commercial windows-version of the agent?