We have a piece of network equipment which appears to be logging in a not entirely friendly fashion (to be politically correct), in that it is including a linefeed (0x0a ASCII hex) in log messages for formatting purposes. Unfortunately, from what I can tell syslog-ng 1.4.11 is getting confused with the linefeed, so the log message up to the linefeed is getting logged correctly but the part after the linefeed is being prepended to the next incoming message. Therefore the filter for this unit is applied to the first part, resulting in it being written to its file, but the filter for the next message is applied to the remainder (the next message plus the prepended remainder from the previous). (Yes, I know it's confusing, I've just spent a while tracking it down. I can provide additional detail if needed...) My question is, is there somewhere in the syslog-ng code where I can easily parse the incoming syslog message and replace linefeeds with something benign, such as spaces or tabs? Or is there another solution that would be better? In the meantime we're opening a bug with the vendor since I consider this their issue, but knowing vendors I'm not confident in their addressing the problem quickly. Thanks for any help... And thanks for syslog-ng! -- Michael Garvin mailto:mgarvin@carolinabroadband.com