2015-03-10 19:59 GMT+01:00 Nathan Brown <[email protected]>: > As a side note there is a feature in mlogger that will try and collapse > multiline log messages into a single message The -I option. This is > conjunction with the parser options I posted earlier will get you what you > want. > > https://github.com/nbrownus/mlogger > > I have just recently worked on the util-linux logger (the one that actually is shipped with linux by default). They seem to be quite open to suggestions. Would you consider adding that functionality? There is an active repo at github here:
https://github.com/karelzak/util-linux/issues Rainer > On Tue, Mar 10, 2015 at 12:47 AM, Rainer Gerhards < > [email protected]> > wrote: > > > 2015-03-09 23:03 GMT+01:00 David Lang <[email protected]>: > > > > > On Mon, 9 Mar 2015, Troels Arvin wrote: > > > > > > Hello, > > >> > > >> Using rsyslog 7.4.7. > > >> > > >> Once in a while, some equipment sends a message which includes newline > > >> chars into our central syslog server. This disturbs my filtering of > > /var/ > > >> log/messages. > > >> > > >> Can rsyslog be configured to replace incoming newline characters with > > >> another character, such as a space? > > >> > > > > > > the 'right' think to happen is to have the newline replaced with #012 > to > > > match the rest of the control character escaping. > > > > > > This isn't currently > > > > > > Oh, no, it is happening! > > > > > > > happening because traditionally a newline indicated the end of the log > > > message, so it didn't need escaping, and when it became possible to > have > > a > > > newline in the message, > > > > > > yeah *inside* the message. I think what happens here is that the message > is > > sent via TCP syslog, and there LF is the *frame delimitor*. So we > actually > > have a protocol error in this case - the LF indicates that a new message > > begins. As such, it is not part of the message itself. > > > > It's hard to fix in a consistent way. There probably can some heuristics > be > > applied, but there is so much more on the todo list than to fix a broken > > sender. If it's important to the OP, he might want to ask Adiscon for a > > quote on getting this implemented (no promise, though, that there is any > > way at all to fix that situation). > > > > Rainer > > > > > > > it didn't get added. > > > > > > Rainer, do you want a bug for this? or will you just add it to your > todo > > > list? > > > > > > David Lang > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
