As a side note there is a feature in mlogger that will try and collapse multiline log messages into a single message The -I option. This is conjunction with the parser options I posted earlier will get you what you want.
https://github.com/nbrownus/mlogger On Tue, Mar 10, 2015 at 12:47 AM, Rainer Gerhards <[email protected]> wrote: > 2015-03-09 23:03 GMT+01:00 David Lang <[email protected]>: > > > On Mon, 9 Mar 2015, Troels Arvin wrote: > > > > Hello, > >> > >> Using rsyslog 7.4.7. > >> > >> Once in a while, some equipment sends a message which includes newline > >> chars into our central syslog server. This disturbs my filtering of > /var/ > >> log/messages. > >> > >> Can rsyslog be configured to replace incoming newline characters with > >> another character, such as a space? > >> > > > > the 'right' think to happen is to have the newline replaced with #012 to > > match the rest of the control character escaping. > > > > This isn't currently > > > Oh, no, it is happening! > > > > happening because traditionally a newline indicated the end of the log > > message, so it didn't need escaping, and when it became possible to have > a > > newline in the message, > > > yeah *inside* the message. I think what happens here is that the message is > sent via TCP syslog, and there LF is the *frame delimitor*. So we actually > have a protocol error in this case - the LF indicates that a new message > begins. As such, it is not part of the message itself. > > It's hard to fix in a consistent way. There probably can some heuristics be > applied, but there is so much more on the todo list than to fix a broken > sender. If it's important to the OP, he might want to ask Adiscon for a > quote on getting this implemented (no promise, though, that there is any > way at all to fix that situation). > > Rainer > > > > it didn't get added. > > > > Rainer, do you want a bug for this? or will you just add it to your todo > > list? > > > > David Lang > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
