On Thu, Sep 1, 2011 at 2:57 PM, <mike@lague.org> wrote:
I'm using syslog-ng 3.0.5 (OSE).
I've noticed that if a multi-line message is sent by an application to syslog-ng via a unix-stream source, the first line is logged to the right destination, and the next line goes to a default destination. E.g., if a message like "Test message line 1\nTest message line 2\n" is sent, "Test message line 1" appears in the expected destination file, while "Error processing log message: Test message line 2" appears in the default destination.
This limitation (which does not exist with unix-dgram sources) seems to have been reported a number of times on various lists.
The feature comparison table at
http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/... indicates that there is no support for multi-line messages in OSE 3.2, but there is such support in PE 4.0
Yet I thought a saw a message which indicated that there might be support for multi-line messages in an OSE release? Can someone confirm this? Also, is there any way around this limitation in earlier OSE releases?
Thank you, --Mike
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hey, /dev/log is an AF_UNIX socket, so you can use unix-dgram in place of unix-stream with no problems (I have in the past for this exact problem). Also, using a UDP (and I imagine TCP) source will preserve newlines. Regards,