[syslog-ng]Re: messages with newlines

[Dmitry Frolov]

Hello Balazs,

Thanks for your explanations.

On Sat, Feb 01, 2003 at 12:04:36PM +0100, Balazs Scheidler wrote:

> > I found that problem described only occurs if udp packet does not end with \0.
> > This id little test for it:
> 
> syslog-ng takes \n as line terminator. Generally you should not include '\n'
> in log messages.

In general i agree with that, using '\n' in single log message usually
makes no sense since it's replaced with space (or even literal '\n' under
solaris) and message loses its formatting anyway..
But i'm forced to deal with such logs, as some applications log in both local
files and syslog with same calls, and messages contain newlines.
I have to turn off splitting udp log messages with '\n', so single
packet would be logged as single message in all cases...
Hope following won't lead to something bad...

--- src/sources.c.orig  Wed Jan  8 12:31:37 2003
+++ src/sources.c       Fri Jan 31 18:07:13 2003
@@ -110,3 +110,3 @@
        eol = memchr(closure->buffer, '\0', closure->pos);
-       if (eol == NULL)
+       if (eol == NULL && !closure->dgram)
                eol = memchr(closure->buffer, '\n', closure->pos);


> Program names should not contain spaces either. There's no way to know
> whether the first word is a hostname or is part of the program. (though the
> option bad_hostname() added lately should help you here)

I see. syslogd message format seems to be rather fuzzy.


-- 
Dmitry Frolov, Zenon N.S.P. (095) 250-4629, http://www.zenon.net/