[syslog-ng] RFC5424 sending - dest=unix-stream. Framing?

Scheidler, Bal√°zs balazs.scheidler at balabit.com
Fri Feb 2 05:48:09 UTC 2018

If the new lines at the end are ok, and the messages dont contain newlines
themselves, you should be fine. If both destination and source is
unix-STREAM(). Don't you hapoen to use unix-dgram() somewhere? That would
take the datagram fragments as individual messages.

Can you show me the framing errors you mention?

On Feb 1, 2018 22:33, "Declan White" <declanw at is.bbc.co.uk> wrote:

I have syslog-ng pumping data into a unix-stream destination

Data going into this domain socket has lots of adventures, and then emerges
as a source unix-stream on another host.
Both have flags(syslog-protocol), but the data gets framing errors at the

I think it's become a bytestream (instead of a message stream) enroute, and
the recv() is relying on only getting one message at a time, because it
can't know the message length any other way, as unix-stream gets messages
without framing(?).

Is there a way to salvage this? (I noticed TLS might add framing, but since
the tunnel is already TLS ...)

Declan White
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180202/9590bbd9/attachment.html>

More information about the syslog-ng mailing list