I'm  using syslog-ng 3.0.5 (OSE). 

I've noticed that if a multi-line message is sent by an application to  syslog-ng  via a unix-stream source, the first line is logged to the right destination, and the next line goes to a default destination. E.g., if a message like
"Test message line 1\nTest message line 2\n"
is sent,
"Test message line 1"
appears in the expected destination file, while
"Error processing log message: Test message line 2"
appears in the default destination.

This limitation (which does not exist with unix-dgram sources) seems to have been reported a number of times on various lists.

The feature comparison table at
http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/features/comparison
indicates that there is no support for multi-line messages in OSE 3.2, but there is such support in PE 4.0

Yet I thought a saw a message which indicated that there might be support for multi-line messages in an OSE release? Can someone confirm this? Also, is there any way around this limitation in earlier OSE releases?

Thank you,
--Mike






______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq