2015-03-09 23:03 GMT+01:00 David Lang <[email protected]>: > On Mon, 9 Mar 2015, Troels Arvin wrote: > > Hello, >> >> Using rsyslog 7.4.7. >> >> Once in a while, some equipment sends a message which includes newline >> chars into our central syslog server. This disturbs my filtering of /var/ >> log/messages. >> >> Can rsyslog be configured to replace incoming newline characters with >> another character, such as a space? >> > > the 'right' think to happen is to have the newline replaced with #012 to > match the rest of the control character escaping. > > This isn't currently
Oh, no, it is happening! > happening because traditionally a newline indicated the end of the log > message, so it didn't need escaping, and when it became possible to have a > newline in the message, yeah *inside* the message. I think what happens here is that the message is sent via TCP syslog, and there LF is the *frame delimitor*. So we actually have a protocol error in this case - the LF indicates that a new message begins. As such, it is not part of the message itself. It's hard to fix in a consistent way. There probably can some heuristics be applied, but there is so much more on the todo list than to fix a broken sender. If it's important to the OP, he might want to ask Adiscon for a quote on getting this implemented (no promise, though, that there is any way at all to fix that situation). Rainer > it didn't get added. > > Rainer, do you want a bug for this? or will you just add it to your todo > list? > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
