On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:
> We're seeing lines in /var/log/messages that are chopped off. They
> should look like this:
>
> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net> ,to=To: ""Graeme Ross"" <gross@mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858"
>
> But they look like this:
>
> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net>
>
>
> Anyone seen this?
>
> Thanks
>
>
>

Well, can you tell us a little bit more on your configuration? What
protocol do you use on the source side? Do you happen to use the new
RFC5424 style protocol, or the legacy one?

What is generating those messages, can you show us a tcpdump/strace
snippet that shows how that frame is travelling the network?

Also, syslog-ng 3.0 does not remove embedded NL characters by default,
maybe the rest of the message continues on the next line?

You can reenable the previous behaviour by using the 'no-multi-line'
flag for your source or destination (e.g. you can change the multi-line
handling not just for a given source, but also handle the same message
differently in different destinations).

--
Bazsi

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html