[syslog-ng] is there support for multi-line messages in a syslog-ng OSE release?

[Lance Laursen]

On Thu, Sep 1, 2011 at 2:57 PM, <mike at lague.org> wrote:

> I'm  using syslog-ng 3.0.5 (OSE).
>
> I've noticed that if a multi-line message is sent by an application to
> syslog-ng  via a unix-stream source, the first line is logged to the right
> destination, and the next line goes to a default destination. E.g., if a
> message like
> "Test message line 1\nTest message line 2\n"
> is sent,
> "Test message line 1"
> appears in the expected destination file, while
> "Error processing log message: Test message line 2"
> appears in the default destination.
>
> This limitation (which does not exist with unix-dgram sources) seems to
> have been reported a number of times on various lists.
>
> The feature comparison table at
>
> http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/features/comparison
> indicates that there is no support for multi-line messages in OSE 3.2, but
> there is such support in PE 4.0
>
> Yet I thought a saw a message which indicated that there might be support
> for multi-line messages in an OSE release? Can someone confirm this? Also,
> is there any way around this limitation in earlier OSE releases?
>
> Thank you,
> --Mike
>
>
>
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
Hey,

/dev/log is an AF_UNIX socket, so you can use unix-dgram in place of
unix-stream with no problems (I have in the past for this exact problem).
Also, using a UDP (and I imagine TCP) source will preserve newlines.

Regards,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110914/c0551fa2/attachment.htm