[syslog-ng] multi-line logs and program/facility filters

[Scheidler, Balázs]

Hi,

this is probably because syslogd used SOCK_DGRAM socket for /dev/log
whereas your syslog-ng configuration tells syslog-ng to use SOCK_STREAM.
The libc implementation supports both. Make sure you use unix-dgram() in
syslog-ng. the system() source in syslog-ng defaults to unix-dgram() if I
remember correctly.

btw: multi-line log messages are not supported over syslog network
transports in general, though its original UDP transport may work.

Bazsi

On Fri, Aug 10, 2018 at 5:36 PM, Jim Hendrick <james.r.hendrick at gmail.com>
wrote:

> Don't give up quite yet. There are better people than I by far on this
> list :-)
>
> Btw ... the program destination ran pretty well with no performance impact
> or anything.  "Use the source young padawan "
>
>
> On Fri, Aug 10, 2018, 10:51 AM Michael Thénault <
> michael.thenault at gmail.com> wrote:
>
>> Ok, well that cannot be a solution for us because of different
>> reasons: performance (embedded environment), probability to add bugs
>> ...
>> I guess we'll have to go reconsider keeping syslogd which doesn't have
>> this issue.
>>
>> Regards,
>> Michael
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?
>> product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180810/38aff50c/attachment.html>