[syslog-ng]embedded newlines

Chuck Berg syslog-ng@lists.balabit.hu
Mon, 23 Feb 2004 11:09:51 -0500


A message with an embedded newline will cause the next message to be mangled.
For example:

dream:~$ echo -ne '<27>test: test: foo\nfoo' | nc -u loghost 514

Produces this:

Feb 17 12:38:53 dream test: foo
Feb 17 12:38:54 xyzzy foo<38>Feb 17 12:38:54 sshd[18588]: Accepted publickey for nobody from 10.1.2.3 port 48651 ssh2

Where xyzzy is an innocent victim who just happened to send the next message.

I see that this has been discussed on the list several times over the past few
years. Is there no proper solution possible? Can't we just end the message at the
end of the packet (as if it was always null/newline terminated)?

It seems to me that no matter what the content of a message, it should not cause
another message to be mangled.