[syslog-ng] Colon embedded in messages (:)

[chris packham]

 >>> On 9/30/2009 at  9:26 AM, James Kelly <james.kelly at hmsinc.com> wrote: 
> Thanks a lot. That seems to have worked a lot better but has introduced 
> another problem. The messages are split up into too many lines and, when 
> there is a match, the first of N lines are removed, still creating unwanted 
> messages.
> 
> For example, a pretty small insert spans 3 lines... There was a match on the 
> 2nd line, so it is not printed. However, the 1st and 3rd were.
> 
> 2009-09-29T16:21:16-04:00 blahh-rep2 postgres [10440-1] 
> postgres-blahh-10.100.10.34(15779)-4690-2009-09-29 16:21:16 EDT-LOG: 
> statement: insert into
> 2009-09-29T16:21:16-04:00 blahh-rep2 postgres [10440-3] '1000000000000000');

I think you'll find is a postgres thing. syslog-ng does not split messages up based on size (at least as far as I've seen). I think there is some behaviour to do with carriage returns "\n" embedded in your log data but there are some config options to help with that, search the mailing list/admin guide for that if it turns out to be the case.