[syslog-ng] multi-line logs and program/facility filters
balazs.scheidler at oneidentity.com
Fri Aug 10 18:06:23 UTC 2018
this is probably because syslogd used SOCK_DGRAM socket for /dev/log
whereas your syslog-ng configuration tells syslog-ng to use SOCK_STREAM.
The libc implementation supports both. Make sure you use unix-dgram() in
syslog-ng. the system() source in syslog-ng defaults to unix-dgram() if I
btw: multi-line log messages are not supported over syslog network
transports in general, though its original UDP transport may work.
On Fri, Aug 10, 2018 at 5:36 PM, Jim Hendrick <james.r.hendrick at gmail.com>
> Don't give up quite yet. There are better people than I by far on this
> list :-)
> Btw ... the program destination ran pretty well with no performance impact
> or anything. "Use the source young padawan "
> On Fri, Aug 10, 2018, 10:51 AM Michael Thénault <
> michael.thenault at gmail.com> wrote:
>> Ok, well that cannot be a solution for us because of different
>> reasons: performance (embedded environment), probability to add bugs
>> I guess we'll have to go reconsider keeping syslogd which doesn't have
>> this issue.
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng