[syslog-ng] stupid question: syslogging plaintext non-syslog-format messages unchanged (netconsole)
Nix
nix at esperi.org.uk
Tue Oct 20 22:30:34 CEST 2009
So I'm trying to get the Linux kernel netconsole working, to diagnose
some nasty persistent panics... and after some struggle I've got most of
it working, but I can't make syslog-ng (3.0 from git as of tonight)
cooperate. The problem seems to be that netconsole is handing syslog-ng
completely bare text lines over UDP, and syslog-ng is persistently
trying to linebreak them at apparently random space characters, even
with the no-parse flag turned on.
Some specifics.
I'm receiving the netconsole messages with the following (trimmed down
from the real 500-line-long config, all global options preserved in this
trim, I'm pretty sure this is everything relevant but I haven't tested
this on its own yet 'cos it would break syslogging for a fairly large
network to actually replace the syslog-ng config with this):
,----
| options
| {
| keep_hostname(no);
| create_dirs(1);
| perm(0644);
| dir_perm(0755);
| log_fifo_size(1000);
| use_dns(yes);
| dns_cache(yes);
| use_fqdn(no);
| log_iw_size(5192);
| flush_lines(100);
| flush_timeout(1000);
| stats_freq(3600);
| chain_hostnames(yes);
| };
|
| source netconsole
| {
| udp(ip(0.0.0.0) port(24183) log_fetch_limit(100) flags(no-parse no-multi-line));
| };
|
| # A bare template, for netconsole messages.
| template bare
| {
| template("$MSG\n");
| template_escape(no);
| };
|
| destination netconsole
| {
| file("/var/log/$HOST-netconsole.log"
| template(bare));
| };
|
| log
| {
| source(netconsole);
| destination(netconsole);
| };
`----
but this is not enough. Most of the time the same message is received
over an ordinary syslog source, too, so I can compare the two. If the
syslogged message reads:
,----
| Oct 20 21:17:53 mutilate warning: : [ 6783.237435] pktcdvd: Fixed packets, 32 blocks, Mode-2 disc
| Oct 20 21:17:53 mutilate warning: : [ 6783.238541] pktcdvd: write caching control failed
| Oct 20 21:17:53 mutilate warning: : [ 6783.238547] pktcdvd: 55 10 00 00 00 00 00 00 14 00 00 00 - sense 05.00.00 (Illegal request)
`----
the netconsole message that's logged using the configuration above reads
,----
| [ 6783.237435] pktcdvd: Fixed packets,
| 32 blocks,
| Mode-2 disc
| [ 6783.238541] pktcdvd: write caching control failed
| [ 6783.238547] pktcdvd:
| 55
| 10
| 00
| 00
| 00
| 00
| 00
| 00
| 14
| 00
| 00
| 00
| -
| sense 05.00.00
| (Illegal request)
`----
This is obviously not sane. Removing the no-multi-line flag doesn't
change anything at all (I only added it in desperation, because I *want*
linebreaks in the original message to be reproduced in the output: I
just don't want *more* linebreaks than are present in the original
output), so that's not it either. I'm logging kernel messages using
,----
| source local
| {
| unix-stream("/dev/log" flags(no-multi-line));
| internal();
| file("/proc/kmsg" program_override("kernel: ") flags(kernel no-multi-line));
| };
`----
and things hanging off that, without incident: no random linebreaks or
anything.
So, what am I missing? It's probably incredibly obvious, but I've blown
several hours hacking at configs and digging through the syslog-ng
source and have seen nothing to indicate what's going on...
More information about the syslog-ng
mailing list