2012/11/7 Rainer Gerhards <[email protected]> > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Johan Gunnarsson > > Sent: Wednesday, November 07, 2012 10:05 AM > > To: [email protected] > > Subject: [rsyslog] Make multiline messages survive on remote host > > > > I'm having trouble making multiline messages survive when forwardning > > them > > to a remote rsyslog host (both client and server running rsyslog > > 5.8.10). > > > > I am using imfile and $InputFileReadMode 2 (for understandig indented > > multiline logs) to read tomcat catalina logs which contains lots of > > indented multiline java stacktraces and it works just fine when pushing > > them to local syslog but at the remote host every line has a date > > stamp. Is > > there any way to make this work? > > Well, the core problem is that LF and syslog does not play nicely > together: in the (old) industry standard LF is the frame delimiter. In > rsyslog, you can use octet-counted framing, which will enable proper > transmission of LFs inside messages. > > So, as far as I understand octet-counted framing is understood by default by imtcp and i changed the sender side to *.* @@(o)192.168.56.102:514to enable octet-counted framing. The logs still end up malformed on the server side, did i get something wrong?
-- Johan Gunnarsson _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
