https://bugzilla.balabit.com/show_bug.cgi?id=215 Summary: syslog-ng v3 - tcp() does not support no-multi-line as docs reference. Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: balabit@32ths.com Type of the Report: --- Estimated Hours: 0.0 So after doing some test cases, I've noticed that on no-multi-line is not stripping newlines on v3.3.7. I've not tested previous versions yet. Here is my syslog-ng config: source s_net_tcp { tcp(ip(0.0.0.0) port(514) flags(no-multi-line)); }; destination all { file("/var/log/all"); }; log { source(s_net_tcp); destination(all); flags(final); }; I've also attempted to do this with no-parse flags passed in to no avail. When using the udp() source, it works just fine. My test case: # cat blah line1 line2 line3 # cat blah | nc -r -n myhost 514 And on "myhost" Jan 2 12:25:16 192.2.0.1 line1 Jan 2 12:25:16 192.2.0.1 line2 Jan 2 12:25:16 192.2.0.1 line3 So I assume this has something to do with it: https://bugzilla.balabit.com/show_bug.cgi?id=74 Particularly about newlines being message terminators over tcp(), however, why do the docs even say tcp() supports the no-multi-line flag? Maybe there is a way to adjust the terminator if this is the case? I must admit, I was curious what syslog-ng would do if the message size exceeded the mtu of the network. With UDP, I assume the end of the packet is the end of the message so any messages large enough to span two udp packets would actually be two log entries. I assumed it would also be the case with TCP, even if it is stream based. So the potential problems I see are: 1. tcp() doesn't really support no-multi-line (bug) or 2. the docs should be updated to not say it supports no-multi-line (bug) or 3. I've overlooked the doc references or 4. I'm missing some option (terminator?) in order to get tcp() to work with no-multi-line. (env) Thanks as always, - Mike -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.