[syslog-ng] multiline messages via unix socket

Balazs Scheidler bazsi at balabit.hu
Wed Sep 2 12:55:49 CEST 2009

On Fri, 2009-08-21 at 19:29 +0800, Max Arnold wrote:
> Hello all!
> Can someone look at this bugreport: http://bugs.python.org/issue6444
> In short, when multiline log messages sent via /dev/log socket they are splitted into
> multiple log entries. Only first entry will have proper timestamp and facility.
> This behavior differs from sysklogd and metalog, where multiple lines are concatenated.
> Even syslog-ng itself concatenates them when used via udp socket.
> Tested on syslog-ng-2.1.3.

I guess this depends on whether you are using unix-stream() or

The first concatenates it, the 2nd doesn't. Simply because unix-dgram
knows about the size of the datagrams whereas unix-stream doesn't.


More information about the syslog-ng mailing list