[syslog-ng] [Bug 131] New: XML tags being stripped

[syslogng at feystorm.net]

Sent: Wed Aug 24 2011 10:49:29 GMT-0600 (MST)
From: bugzilla at bugzilla.balabit.com
To: syslog-ng at lists.balabit.hu
Subject: [syslog-ng] [Bug 131] New: XML tags being stripped
> https://bugzilla.balabit.com/show_bug.cgi?id=131
>
>             Summary: XML tags being stripped
>             Product: syslog-ng
>             Version: 3.0.x
>            Platform: All
>          OS/Version: Linux
>              Status: NEW
>            Severity: normal
>            Priority: unspecified
>           Component: syslog-ng
>          AssignedTo: bazsi at balabit.hu
>          ReportedBy: jsu2 at emory.edu
> Type of the Report: bug
>     Estimated Hours: 0.0
>
>
> Is there a known bug where syslog-ng arbitrarily strips xml tags from log messages?  That is, some of our logs output xml, and syslog-ng seems to be stripping
> some of these tags before writing them.  In particular, we have syslog-ng client configured to read from a local log file, send the log file to the syslog-ng
> server.  The server does some basic csv parsing before writing it out.  If this problem is fixed in a newer version, please let me know which version.
>
> Here's what the original log file should look like:
>
> 2011-08-24 12:00:02,685 INFO [Thread-35674] - [MessageIdentificationSyncCommand] Processing message<?xml version="1.0" encoding="UTF-8"?>
>
> <PurchaseOrderMessage version="2.2">
>
> <Header>
>
> <MessageId>3125206c-5063-4465-a020-0131fc850885</MessageId>
<SNIP>
> But, it shows up on syslog-ng server as:
>
> intesbprod1 [10857]: Error processing log message:<PurchaseOrderMessage version="2.2">
> intesbprod1 :
> intesbprod1 :
> intesbprod1 : 00:02.183-04:00</Timestamp>
> intesbprod1 :
> intesbprod1 :
>

This isnt a bug. Your log file is in an invalid format. All of the 
message must be on a single line, syslog-ng treats each line of the 
input file as a separate message. Think about it this way, suppose your 
XML had "2011-08-24 12:00:02,685 INFO" right in the middle of it on a 
new line, how would syslog-ng be able to tell the difference between a 
new log entry and this text in the middle of the log?
Basically the only way to fix this would be to have whatever is writing 
out the log file strip out all newlines.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110824/3fc8abcb/attachment.htm