> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of David Lang > Sent: Wednesday, November 07, 2012 11:08 PM > To: rsyslog-users > Subject: Re: [rsyslog] Make multiline messages survive on remote host > > On Wed, 7 Nov 2012, David Lang wrote: > > > On Wed, 7 Nov 2012, Johan Gunnarsson wrote: > > > >> I'm having trouble making multiline messages survive when > forwardning them > >> to a remote rsyslog host (both client and server running rsyslog > 5.8.10). > >> > >> I am using imfile and $InputFileReadMode 2 (for understandig > indented > >> multiline logs) to read tomcat catalina logs which contains lots of > >> indented multiline java stacktraces and it works just fine when > pushing > >> them to local syslog but at the remote host every line has a date > stamp. Is > >> there any way to make this work? > > > > what needs to happen is for the imfile module to escape the lf and > replace it > > with #015 (following the standard rsyslog escape logic). This should > be a > > pretty trivial modification to the source to do this. I'll look at > throwing > > together a patch soon if someone else doesn't do it first. > > I think this trivial patch will do the job. > > In the cases where a newline was left in the message before, it now > truncates > the pending message by one character and then adds the string "#015" to > the > message in it's place. > > note that I have not tested this yet, and I won't get a chance to for a > while > (possibly not even today)
David, this sounds pretty useful, but I am a bit hesitant to apply it as is. Shouldn't there be config options to turn this on or off? I can see that some folks really want to have the LF instead of the escape... Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
