[syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off

Joe Hansen yrmf250 at yahoo.com
Wed Aug 26 00:48:30 CEST 2009


Just when things were going well, syslog-ng started to chop off lines again.  It seems to be doing this under heavy load.

Will this get fixed in the later version?

thanks,
Joe

--- On Fri, 6/19/09, Joe Hansen <yrmf250 at yahoo.com> wrote:

From: Joe Hansen <yrmf250 at yahoo.com>
Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off
To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>
Received: Friday, June 19, 2009, 9:32 PM

The application is custom in-house.  I'm really not sure what RFC they've followed.  However your suggestion about using 'no-multi-line' seems to have take care of the split lines.

Thanks,
Jo

--- On Fri, 6/19/09, Balazs Scheidler <bazsi at balabit.hu> wrote:

From: Balazs Scheidler <bazsi at balabit.hu>
Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off
To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>
Received: Friday, June 19, 2009, 4:38 AM

On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:
> We're seeing lines in /var/log/messages that are chopped off.  They
> should look like
 this:
> 
> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info at callcentres.net"" <info at callcentres.net> ,to=To: ""Graeme Ross"" <gross at mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858"
> 
> But they look like this:
> 
> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info at callcentres.net"" <info at callcentres.net> 
> 
> 
> Anyone seen this?
> 
> Thanks
> 
> 
> 

Well, can you tell us a little bit more on your configuration? What
protocol do you use on the source side? Do you happen to use the new
RFC5424 style protocol, or the legacy one?

What is generating those messages, can you show us a tcpdump/strace
snippet that shows how that frame is travelling the network?

Also, syslog-ng 3.0 does not remove embedded NL characters by default,
maybe the rest of the message continues on the next line?

You can reenable the previous behaviour by using the 'no-multi-line'
flag for your source or destination (e.g. you can change the multi-line
handling not just for
 a given source, but also handle the same message
differently in different destinations).

-- 
Bazsi


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html



      
Looking for the perfect gift? Give the gift of Flickr!
-----Inline Attachment Follows-----

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html




      __________________________________________________________________
Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now
http://ca.toolbar.yahoo.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090825/5bb003b6/attachment.htm 


More information about the syslog-ng mailing list