> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Florian Crouzat > Sent: Friday, April 20, 2012 9:32 AM > To: [email protected] > Subject: Re: [rsyslog] Rsyslog splitting long-lines into multiple > smaller one > > Le 20/04/2012 07:54, Rainer Gerhards a écrit : > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Jacob Steinberger > >> Sent: Thursday, April 19, 2012 7:52 PM > >> To: rsyslog-users > >> Subject: Re: [rsyslog] Rsyslog splitting long-lines into multiple > >> smaller one > >> > >> Maybe I'm missing something, but your description of "..." followed > by > >> multiple lines of errors, thus split lines and not a single line, is > >> standard for java logging. Are you sure what you're seeing isn't > just > >> the expected output from java? > > Well, I have a log4j FILE appender that cohabits with the syslog > appender for the same logs. When java issue a long log line, the FILE > appender logs it just fine whereas the syslog appender logs > multiple-lines for it (first one ending with '...'). > > What makes me think it's not java/log4j but syslog is that all of the > multiple lines except the first one aren't prefixed with my log4j > layout > as I) explained in my initial post.
That's what I said: the framing is incorrect. It neither works as far as the industry standard is concerned (by introducing \n inside the message - as soon as it is published, you can read about that in RFC6587) nor does it use standard framing (RFC5425). So it's simply broken. > > > The problem is that the syslog appenders are seriously broken. The > emit > > malformed messages with wrong framing. The end result is what is > being > > reported here. > > > > As part of a training project, we have hacked together some appender > which > > worked at least in lab (YMMV). See here: > > > > http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/ > > I'll see with my dev about that appender, and wether or not we can have > such a thing in production, as I assume it's not maintained and never > updated ? Not sure other appenders are though. Too early to say. If there is sufficient interest and a user base, it's status may be promoted. I am not a java wiz, so I have not yet really dug deeper into that. Obviously I could if it turns out to be useful and nobody else takes up that task. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
