[syslog-ng]Linefeed in incoming messages

[todd.glassey@att.net]

B-Man - one easy fix is to send the message length as an 
optional flag to the system, that is if this could be 
added to the "offensive piece of networking equipment". 

Then if the LF is detected before the EOM count is 
reached then there is some residual processing that this 
message will need , whatever that is. 


T.

--
Regards,
Todd
> > My question is, is there somewhere in the syslog-ng code where I can
> > easily parse the incoming syslog message and replace linefeeds with
> > something benign, such as spaces or tabs?  Or is there another solution
> > that would be better?  In the meantime we're opening a bug with the
> > vendor since I consider this their issue, but knowing vendors I'm not
> > confident in their addressing the problem quickly.
> 
> linefeeds take an important role in syslog messages, they terminate them. So
> syslog-ng takes its input packet, splits it by linefeeds and splits each of
> these parts as separate messages. As you see it would be difficult to skip
> processing linefeed characters because it would broke other syslog clients.
> You may try looking around the function do_read_line() in sources.c and
> change it the way that fits you, or wait for your vendor to fix the problem.
> 
> -- 
> Bazsi
> PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng