You can try setting the log_msg_size() to increase the maximum msg size. What kind of source do you use? M On Tue, 2009-08-25 at 15:48 -0700, Joe Hansen wrote:
Just when things were going well, syslog-ng started to chop off lines again. It seems to be doing this under heavy load.
Will this get fixed in the later version?
thanks, Joe
--- On Fri, 6/19/09, Joe Hansen <yrmf250@yahoo.com> wrote:
From: Joe Hansen <yrmf250@yahoo.com> Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu> Received: Friday, June 19, 2009, 9:32 PM
The application is custom in-house. I'm really not sure what RFC they've followed. However your suggestion about using 'no-multi-line' seems to have take care of the split lines.
Thanks, Jo
--- On Fri, 6/19/09, Balazs Scheidler <bazsi@balabit.hu> wrote:
From: Balazs Scheidler <bazsi@balabit.hu> Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu> Received: Friday, June 19, 2009, 4:38 AM
On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote: > We're seeing lines in /var/log/messages that are chopped off. They > should look like this: > > Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header > info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net> ,to=To: ""Graeme Ross"" <gross@mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858" > > But they look like this: > > Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header > info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net> > > > Anyone seen this? > > Thanks > > >
Well, can you tell us a little bit more on your configuration? What protocol do you use on the source side? Do you happen to use the new RFC5424 style protocol, or the legacy one?
What is generating those messages, can you show us a tcpdump/strace snippet that shows how that frame is travelling the network?
Also, syslog-ng 3.0 does not remove embedded NL characters by default, maybe the rest of the message continues on the next line?
You can reenable the previous behaviour by using the 'no-multi-line' flag for your source or destination (e.g. you can change the multi-line handling not just for a given source, but also handle the same message differently in different destinations).
-- Bazsi
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
______________________________________________________________ Looking for the perfect gift? Give the gift of Flickr!
-----Inline Attachment Follows-----
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
______________________________________________________________________ Looking for the perfect gift? Give the gift of Flickr! ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D