syslog-ng 3.0 seem to chop some of the long lines off
We're seeing lines in /var/log/messages that are chopped off. They should look like this: v\:* { BEHAVIOR: url(#default#VML) } o\:* { BEHAVIOR: url(#default#VML) } w\:* { BEHAVIOR: url(#default#VML) } .shape { BEHAVIOR: url(#default#VML) } st1\:* { BEHAVIOR: url(#default#ieooui) } @font-face { font-family: MS Mincho; } @font-face { font-family: Tahoma; } @font-face { font-family: Calibri; } @font-face { font-family: Verdana; } @font-face { font-family: Consolas; } @font-face { font-family: MS Sans Serif; } @font-face { font-family: @MS Mincho; } @page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; } A:link { mso-style-priority: 99 } SPAN.MSOHYPERLINK { mso-style-priority: 99 } A:visited { mso-style-priority: 99 } SPAN.MSOHYPERLINKFOLLOWED { mso-style-priority: 99 } P.MSOPLAINTEXT { mso-style-priority: 99 } LI.MSOPLAINTEXT { mso-style-priority: 99 } DIV.MSOPLAINTEXT { mso-style-priority: 99 } P { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR0 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR00 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR000 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR0000 { mso-style-priority: 99 } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } A:link { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline } A:visited { COLOR: purple; TEXT-DECORATION: underline } SPAN.MsoHyperlinkFollowed { COLOR: purple; TEXT-DECORATION: underline } P.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } LI.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } DIV.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } P { FONT-SIZE: 12pt; MARGIN-LEFT: 0cm; MARGIN-RIGHT: 0cm; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto } SPAN.plaintextchar { FONT-FAMILY: Consolas } SPAN.plaintextchar0 { FONT-FAMILY: Consolas } SPAN.plaintextchar00 { FONT-FAMILY: Consolas } SPAN.plaintextchar000 { FONT-FAMILY: Consolas } SPAN.plaintextchar0000 { FONT-FAMILY: Consolas } SPAN.EmailStyle24 { COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle25 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle26 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle27 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle28 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle29 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle30 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle31 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle32 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle33 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle34 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle35 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle36 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle37 { COLOR: #1f497d; FONT-FAMILY: Calibri; mso-style-type: personal } SPAN.EmailStyle38 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle39 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle40 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle41 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle42 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle43 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle44 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle45 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle46 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle47 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle48 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle49 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle50 { COLOR: #1f497d; FONT-FAMILY: Calibri; mso-style-type: personal } SPAN.EmailStyle51 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle52 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle53 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle54 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle55 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle56 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle57 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle58 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle59 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle60 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle61 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle62 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle63 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle64 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle65 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle66 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle67 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle68 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply } DIV.Section1 { page: Section1 } OL { MARGIN-BOTTOM: 0cm } UL { MARGIN-BOTTOM: 0cm } Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net> ,to=To: ""Graeme Ross"" <gross@mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858" But they look like this: Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net> Anyone seen this? Thanks __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.
On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:
We're seeing lines in /var/log/messages that are chopped off. They should look like this:
Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net> ,to=To: ""Graeme Ross"" <gross@mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858"
But they look like this:
Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info@callcentres.net"" <info@callcentres.net>
Anyone seen this?
Thanks
Well, can you tell us a little bit more on your configuration? What protocol do you use on the source side? Do you happen to use the new RFC5424 style protocol, or the legacy one? What is generating those messages, can you show us a tcpdump/strace snippet that shows how that frame is travelling the network? Also, syslog-ng 3.0 does not remove embedded NL characters by default, maybe the rest of the message continues on the next line? You can reenable the previous behaviour by using the 'no-multi-line' flag for your source or destination (e.g. you can change the multi-line handling not just for a given source, but also handle the same message differently in different destinations). -- Bazsi
participants (2)
-
Balazs Scheidler
-
Joe Hansen