Sent: Wed Aug 24 2011 10:49:29 GMT-0600 (MST)
From: bugzilla@bugzilla.balabit.com
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng] [Bug 131] New: XML tags being stripped 
https://bugzilla.balabit.com/show_bug.cgi?id=131

           Summary: XML tags being stripped
           Product: syslog-ng
           Version: 3.0.x
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi@balabit.hu
        ReportedBy: jsu2@emory.edu
Type of the Report: bug
   Estimated Hours: 0.0


Is there a known bug where syslog-ng arbitrarily strips xml tags from log messages?  That is, some of our logs output xml, and syslog-ng seems to be stripping
some of these tags before writing them.  In particular, we have syslog-ng client configured to read from a local log file, send the log file to the syslog-ng
server.  The server does some basic csv parsing before writing it out.  If this problem is fixed in a newer version, please let me know which version.

Here's what the original log file should look like:

2011-08-24 12:00:02,685 INFO [Thread-35674] - [MessageIdentificationSyncCommand] Processing message <?xml version="1.0" encoding="UTF-8"?>

<PurchaseOrderMessage version="2.2">

<Header>

<MessageId>3125206c-5063-4465-a020-0131fc850885</MessageId>
<SNIP>
But, it shows up on syslog-ng server as:

intesbprod1 [10857]: Error processing log message: <PurchaseOrderMessage version="2.2">
intesbprod1 : 
intesbprod1 : 
intesbprod1 : 00:02.183-04:00</Timestamp>
intesbprod1 : 
intesbprod1 :

This isnt a bug. Your log file is in an invalid format. All of the message must be on a single line, syslog-ng treats each line of the input file as a separate message. Think about it this way, suppose your XML had "2011-08-24 12:00:02,685 INFO" right in the middle of it on a new line, how would syslog-ng be able to tell the difference between a new log entry and this text in the middle of the log?
Basically the only way to fix this would be to have whatever is writing out the log file strip out all newlines.