Again, I would try the option I told you about. I guess it works for your case.
Rainer Sent from phone, thus brief. Michael Lopez via rsyslog <[email protected]> schrieb am Mi., 9. Mai 2018, 00:27: > Hi David, > This specific issue occurs from proprietary IBM devices with > a non comform rfc so ya no luck for fixing at source. Even the vendor IBM > doesn't care to fix it so out of luck for this specific device. > > Sincerely, > Michael > > On Tue, May 8, 2018, 4:29 PM Rainer Gerhards, <[email protected]> > wrote: > > > IIRC jgerhards had some Java stack traces send this way and thus he > crafted > > that experimental code. Afaik it works at least for that use case. > > > > Rainer > > > > Sent from phone, thus brief. > > > > David Lang <[email protected]> schrieb am Di., 8. Mai 2018, 22:24: > > > > > On Tue, 8 May 2018, Michael Lopez wrote: > > > > > > > The issue I had in syslogng and which ultimately will be the same > issue > > > in > > > > rsyslog is when receiving the packet with multiple messages the first > > > > message would have a header and the second would not. So what > happened > > is > > > > the first message would go to the assigned hostname file but the > second > > > > message would go to the syslogng server hostname and this is why I > was > > > > regexing at the network input. > > > > > > rsyslog works a bit differently, it would have the sending machine's > > > hostname/IP > > > (unless the second line sent looks enough like a log that it thinks > part > > > of it > > > is a hostname) > > > > > > But let's back up a step, what is it that is generating these > multi-line > > > logs. > > > Can we fix them at the source so they don't cause grief. > > > > > > This is the first time I've heard of this particular problem, and while > > > you can > > > apply a custom parser to the TCP input, I don't think it will let you > > > combine > > > multiple lines into one log message. > > > > > > David Lang > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
