If the new lines at the end are ok, and the messages dont contain newlines themselves, you should be fine. If both destination and source is unix-STREAM(). Don't you hapoen to use unix-dgram() somewhere? That would take the datagram fragments as individual messages. Can you show me the framing errors you mention? On Feb 1, 2018 22:33, "Declan White" <declanw@is.bbc.co.uk> wrote: I have syslog-ng pumping data into a unix-stream destination socketfilething. Data going into this domain socket has lots of adventures, and then emerges as a source unix-stream on another host. Both have flags(syslog-protocol), but the data gets framing errors at the receiver. I think it's become a bytestream (instead of a message stream) enroute, and the recv() is relying on only getting one message at a time, because it can't know the message length any other way, as unix-stream gets messages without framing(?). Is there a way to salvage this? (I noticed TLS might add framing, but since the tunnel is already TLS ...) -- Declan White ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq