B-Man - one easy fix is to send the message length as an optional flag to the system, that is if this could be added to the "offensive piece of networking equipment". Then if the LF is detected before the EOM count is reached then there is some residual processing that this message will need , whatever that is. T. -- Regards, Todd
My question is, is there somewhere in the syslog-ng code where I can easily parse the incoming syslog message and replace linefeeds with something benign, such as spaces or tabs? Or is there another solution that would be better? In the meantime we're opening a bug with the vendor since I consider this their issue, but knowing vendors I'm not confident in their addressing the problem quickly.
linefeeds take an important role in syslog messages, they terminate them. So syslog-ng takes its input packet, splits it by linefeeds and splits each of these parts as separate messages. As you see it would be difficult to skip processing linefeed characters because it would broke other syslog clients. You may try looking around the function do_read_line() in sources.c and change it the way that fits you, or wait for your vendor to fix the problem.
-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng