[syslog-ng] multiline messages via unix socket

Max Arnold lwarxx at gmail.com
Wed Sep 2 14:47:00 CEST 2009


On Wed, Sep 02, 2009 at 10:55:49AM +0000, Balazs Scheidler wrote:
> > Can someone look at this bugreport: http://bugs.python.org/issue6444
> > In short, when multiline log messages sent via /dev/log socket they are splitted into
> > multiple log entries. Only first entry will have proper timestamp and facility.
> > 
> > This behavior differs from sysklogd and metalog, where multiple lines are concatenated.
> > Even syslog-ng itself concatenates them when used via udp socket.
> > 
> I guess this depends on whether you are using unix-stream() or
> unix-dgram().
> 
> The first concatenates it, the 2nd doesn't. Simply because unix-dgram
> knows about the size of the datagrams whereas unix-stream doesn't.

Thank you for reply!

Is it safe to use unix-dgram as a replacement (on Linux)?  I've googled several mailing 
list messages about lesser reliability of datagram oriented sockets.  Are these concerns
still valid?


More information about the syslog-ng mailing list