[prev in list] [next in list] [prev in thread] [next in thread]
List: syslog-ng
Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines
From: Joe Hansen <yrmf250 () yahoo ! com>
Date: 2009-08-26 19:27:33
Message-ID: 619776.15283.qm () web65307 ! mail ! ac2 ! yahoo ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
The problem is not the length of the messages, it is the '\r\n' that the application \
is inserting in the msg. We want syslog-ng to ignore the 'r\n'.
--- On Wed, 8/26/09, ILLES, Marton <illes.marton@balabit.hu> wrote:
From: ILLES, Marton <illes.marton@balabit.hu>
Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off
To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu>
Received: Wednesday, August 26, 2009, 9:34 AM
You can try setting the log_msg_size() to increase the maximum msg size.
What kind of source do you use?
M
On Tue, 2009-08-25 at 15:48 -0700, Joe Hansen wrote:
> Just when things were going well, syslog-ng started to chop off lines
> again. It seems to be doing this under heavy load.
>
> Will this get fixed in the later version?
>
> thanks,
> Joe
>
> --- On Fri, 6/19/09, Joe Hansen <yrmf250@yahoo.com> wrote:
>
> From: Joe Hansen <yrmf250@yahoo.com>
> Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of
> the long lines off
> To: "Syslog-ng users' and developers' mailing list"
> <syslog-ng@lists.balabit.hu>
> Received: Friday, June 19, 2009, 9:32 PM
>
> The application is custom in-house. I'm really not sure what
> RFC they've followed. However your suggestion about using
> 'no-multi-line' seems to have take care of the split lines.
>
> Thanks,
> Jo
>
> --- On Fri, 6/19/09, Balazs Scheidler <bazsi@balabit.hu>
> wrote:
>
> From: Balazs Scheidler <bazsi@balabit.hu>
> Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop
> some of the long lines off
> To: "Syslog-ng users' and developers' mailing list"
> <syslog-ng@lists.balabit.hu>
> Received: Friday, June 19, 2009, 4:38 AM
>
> On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:
> > We're seeing lines in /var/log/messages that are
> chopped off. They
> > should look like this:
> >
> > Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email
> header
> >
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: \
> ""info@callcentres.net"" <info@callcentres.net> ,to=To: ""Graeme Ross"" \
> <gross@mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. \
> Launceston, Tasmania","worker/CPSendWork.cpp:858"
> >
> > But they look like this:
> >
> > Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email
> header
> >
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: \
> ""info@callcentres.net"" <info@callcentres.net>
> >
> >
> > Anyone seen this?
> >
> > Thanks
> >
> >
> >
>
> Well, can you tell us a little bit more on your
> configuration? What
> protocol do you use on the source side? Do you happen
> to use the new
> RFC5424 style protocol, or the legacy one?
>
> What is generating those messages, can you show us a
> tcpdump/strace
> snippet that shows how that frame is travelling the
> network?
>
> Also, syslog-ng 3.0 does not remove embedded NL
> characters by default,
> maybe the rest of the message continues on the next
> line?
>
> You can reenable the previous behaviour by using the
> 'no-multi-line'
> flag for your source or destination (e.g. you can
> change the multi-line
> handling not just for a given source, but also handle
> the same message
> differently in different destinations).
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info:
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
>
> ______________________________________________________________
> Looking for the perfect gift? Give the gift of Flickr!
>
> -----Inline Attachment Follows-----
>
> ______________________________________________________________________________
> Member info:
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
>
> ______________________________________________________________________
> Looking for the perfect gift? Give the gift of Flickr!
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
--
Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html
__________________________________________________________________
Make your browsing faster, safer, and easier with the new Internet Explorer® 8. \
Optimized for Yahoo! Get it Now for Free! at \
http://downloads.yahoo.com/ca/internetexplorer/
[Attachment #5 (text/html)]
<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: \
inherit;">The problem is not the length of the messages, it is the '\r\n' that the \
application is inserting in the msg. We want syslog-ng to ignore the \
'r\n'.<br><br><br><br>--- On <b>Wed, 8/26/09, ILLES, Marton \
<i><illes.marton@balabit.hu></i></b> wrote:<br><blockquote style="border-left: \
2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>From: ILLES, \
Marton <illes.marton@balabit.hu><br>Subject: Re: [syslog-ng] syslog-ng 3.0 seem \
to chop some of the long lines off<br>To: "Syslog-ng users' and developers' mailing \
list" <syslog-ng@lists.balabit.hu><br>Received: Wednesday, August 26, 2009, \
9:34 AM<br><br><div class="plainMail">You can try setting the log_msg_size() to \
increase the maximum msg size.<br>What kind of source do you use?<br><br>M<br><br>On \
Tue, 2009-08-25 at 15:48 -0700, Joe Hansen wrote:<br>> Just when things were \
going well, syslog-ng started to chop off lines<br>> again. It seems to be \
doing this under heavy load.<br>> <br>> Will this get fixed in the later \
version?<br>> <br>> thanks,<br>> Joe<br>> <br>> --- On Fri, 6/19/09, \
Joe Hansen <<a ymailto="mailto:yrmf250@yahoo.com" \
href="/mc/compose?to=yrmf250@yahoo.com">yrmf250@yahoo.com</a>> \
wrote:<br>> <br>> \
From: Joe Hansen <<a ymailto="mailto:yrmf250@yahoo.com" \
href="/mc/compose?to=yrmf250@yahoo.com">yrmf250@yahoo.com</a>><br>> \
Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop \
some of<br>> the long lines \
off<br>> To: "Syslog-ng users' and \
developers' mailing list"<br>> <<a \
ymailto="mailto:syslog-ng@lists.balabit.hu" \
href="/mc/compose?to=syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>> \
Received: Friday, June 19, 2009, 9:32 \
PM<br>> <br>> \
The application is custom in-house. I'm really not sure \
what<br>> RFC they've followed. \
However your suggestion about using<br>> \
'no-multi-line' seems to have take care of the split \
lines.<br>> <br>> \
Thanks,<br>> \
Jo<br>> <br>> \
--- On Fri, 6/19/09, Balazs Scheidler <<a \
ymailto="mailto:bazsi@balabit.hu" \
href="/mc/compose?to=bazsi@balabit.hu">bazsi@balabit.hu</a>><br>> \
wrote:<br>> \
<br>> \
From: Balazs Scheidler <<a ymailto="mailto:bazsi@balabit.hu" \
href="/mc/compose?to=bazsi@balabit.hu">bazsi@balabit.hu</a>><br>> \
Subject: Re: [syslog-ng] \
syslog-ng 3.0 seem to chop<br>> \
some of the long lines off<br>> \
To: "Syslog-ng users' and developers' mailing \
list"<br>> \
<<a ymailto="mailto:syslog-ng@lists.balabit.hu" \
href="/mc/compose?to=syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>> \
Received: Friday, June \
19, 2009, 4:38 AM<br>> \
<br>> \
On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:<br>> \
> We're seeing lines \
in /var/log/messages that are<br>> \
chopped off. They<br>> \
> should look like this:<br>> \
> <br>> \
> Jun 17 00:34:36 bxe1001 \
WORKER[18808]: DEBUG,email<br>> \
header<br>> \
><br>> \
info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: \
""<a ymailto="mailto:info@callcentres.net" \
href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>"" <<a \
ymailto="mailto:info@callcentres.net" \
href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>> ,to=To: \
""Graeme Ross"" <<a ymailto="mailto:gross@mobileemail.vodafone.com.au" \
href="/mc/compose?to=gross@mobileemail.vodafone.com.au">gross@mobileemail.vodafone.com.au</a>>,subject=Turn-key \
call centre for lease. Launceston, \
Tasmania","worker/CPSendWork.cpp:858"<br>> \
> <br>> \
> But they look like this:<br>> \
> <br>> \
> Jun 17 00:34:36 bxe1001 \
WORKER[18808]: DEBUG,email<br>> \
header<br>> \
><br>> \
info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: \
""<a ymailto="mailto:info@callcentres.net" \
href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>"" <<a \
ymailto="mailto:info@callcentres.net" \
href="/mc/compose?to=info@callcentres.net">info@callcentres.net</a>> \
<br>> > \
<br>> > \
<br>> > \
Anyone seen this?<br>> \
> <br>> \
> Thanks<br>> \
> <br>> \
> <br>> \
> <br>> \
<br>> \
Well, can you tell us a little bit more on your<br>> \
configuration? \
What<br>> \
protocol do you use on the source side? Do you happen<br>> \
to use the \
new<br>> RFC5424 \
style protocol, or the legacy one?<br>> \
<br>> \
What is generating those messages, can you show us a<br>> \
\
tcpdump/strace<br>> \
snippet that shows how that frame is travelling \
the<br>> \
network?<br>> \
<br>> \
Also, syslog-ng 3.0 does not remove embedded NL<br>> \
characters by \
default,<br>> \
maybe the rest of the message continues on the next<br>> \
line?<br>> \
<br>> \
You can reenable the previous \
behaviour by using the<br>> \
'no-multi-line'<br>> \
flag for your source or destination (e.g. you \
can<br>> change \
the multi-line<br>> \
handling not just for a given source, but also handle<br>> \
the same \
message<br>> \
differently in different destinations).<br>> \
<br>> \
-- <br>> \
Bazsi<br>> \
<br>> \
<br>> \
______________________________________________________________________________<br>> \
Member \
info:<br>> <a \
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>> \
\
Documentation:<br>> \
<a \
href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>> \
FAQ: <a \
href="http://www.campin.net/syslog-ng/faq.html" \
target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>> \
<br>> \
<br>> \
<br>> <br>> \
______________________________________________________________<br>> \
Looking for the perfect gift? Give the gift of \
Flickr!<br>> <br>> \
-----Inline Attachment Follows-----<br>> \
<br>> \
______________________________________________________________________________<br>> \
Member info:<br>> \
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>> \
Documentation:<br>> \
<a \
href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>> \
FAQ: <a \
href="http://www.campin.net/syslog-ng/faq.html" \
target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>> \
<br>> <br>> \
<br>> <br>> ______________________________________________________________________<br>> \
Looking for the perfect gift? Give the gift of Flickr!<br>> \
______________________________________________________________________________<br>> \
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>> \
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>> \
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" \
target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>> <br>-- <br>Key \
fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 \
670D<br><br>______________________________________________________________________________<br>Member \
info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: \
<a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ: \
<a href="http://www.campin.net/syslog-ng/faq.html" \
target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br><br></div></blockquote></td></tr></table><br>
<hr size=1>
Looking for the perfect gift?<a href="http://www.flickr.com/gift/"><b> Give the gift \
of Flickr!</b></a>
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic