[syslog-ng] Syslog-ng OSE multiline messages support

[Daniel Josue Rodriguez Paiz]

This is one example:

 [parser/msg_parser.c:714]: ERROR: parse_msg: message=<SIP/2.0
CSeq:713601 INVITE
Via:
SIP/2.0/UDP192.168.1.1;branch=z9hG4bKd3a2.99b5ab56.0;received=192.168.1.1

Rsyslog replaces the \n with the string #015#012 so i keep my message in
one line

 [parser/msg_parser.c:714]: ERROR: parse_msg: message=<SIP/2.0
#015#012CSeq:713601 INVITE#015#012Via:
SIP/2.0/UDP192.168.1.1;branch=z9hG4bKd3a2.99b5ab56.0;received=192.168.1.1

But syslog-ng only stores the first line of the message
[parser/msg_parser.c:714]: ERROR: parse_msg: message=<SIP/2.0

Regards,

Daniel

2012/10/25 Gergely Nagy <algernon at balabit.hu>

> Balazs Scheidler <bazsi77 at gmail.com> writes:
>
> >> I have one question, does syslog-ng OSE support multiline parsing logs?
> >> i have one applications that send multiline messages and syslog-ng save
> >> the log of the first line only.
> >
> > syslog-ng core is multiline aware, however a transport is needed that
> > supports multiline messages.
> >
> > such a transport is udp(), which has other issues. syslog() with
> > either udp, tcp or tls supports multiline messages.
> >
> > similarly unix-dgram should work for locally generated multiline
> > messages.
> >
> > the only missing thing is the ability to read local files and
> > recognize multiline barriers, but Algernon is working on solving this.
>
> It is progressing nicely, and it will be available in syslog-ng 3.4 if
> all goes well. I already have indented-multiline support in a state I'm
> reasonably happy with[1], a more flexible solution will be implemented
> once a few other pending issues are resolved.
>
>  [1]:
> https://github.com/algernon/syslog-ng/tree/feature/3.4/indented-multiline
>
> Meanwhile, I'd like to ask what kind of multiline logs does your
> application produce? Can you show a sample, by any chance? That'd help
> me make sure that the multiline reader I'm working on will work for all
> kinds of use-cases.
>
> Thanks in advance!
>
> --
> |8]
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20121025/8e0fb299/attachment.htm