Discussion:
[rsyslog] Rsyslog & newlines
(too old to reply)
Renjith Vijayan
2017-06-15 09:47:16 UTC
Permalink
Raw Message
+ Systemd-dev

Hi,

Does journal ignore the forwarding of logs ending with newline(\n) to
rsyslog? In my system there are some logs send directly via
sd_journal_send() API and ending with newline.
These logs are present in journal, but not in /var/log/messages.

Rainer confirmed that rsyslog does accept logs with newline as seen in mail
below. So is this the case where journal not forwarding the logs due to
newline?

Thanks,
RV
I assume that journal does not forward them. A debug log might help to
validate this assumption. Rsyslog does not reject logs with newlines albeit
they usually cause huge problems in many subsystems and thus it is strongly
recommended to not use them.
Rainer
Sent from phone, thus brief.
Am 15.06.2017 05:00 schrieb "Renjith Vijayan via rsyslog" <
Hi,
I am working on a system where both systemd-journal & rsyslog(7.6.1) are
there. Systemd-journal is configured to forward logs to rsyslog routinely.
I have some logs which ends with newlines & that are directly sent to
journal using sd_journal_send() API's.
I see that although these logs are present in journal, it's not present in
/var/log/messages which is populated by rsyslog. Is rsyslog rejecting these
logs due to the ending newline?
Further, based on some search results on this topic, I tried adding the
following lines to rsyslog.conf, but this didn't help either.
# global directives
$EscapeControlCharactersOnReceive off
$EscapeControlCharactersCStyle off
$ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat
$SpaceLFOnReceive on
$DropTrailingLFOnReception off
Could you please let me know how can I make rsyslog to accept these logs
ending with newline?
Thanks,
RV
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
Lennart Poettering
2017-06-16 07:33:52 UTC
Permalink
Raw Message
Post by Renjith Vijayan
+ Systemd-dev
Hi,
Does journal ignore the forwarding of logs ending with newline(\n) to
rsyslog? In my system there are some logs send directly via
sd_journal_send() API and ending with newline.
These logs are present in journal, but not in /var/log/messages.
Rainer confirmed that rsyslog does accept logs with newline as seen in mail
below. So is this the case where journal not forwarding the logs due to
newline?
Note that the behaviour of journald regarding embedded newlines
changed a couple of times in the past. Have you tested this with a
current systemd version?

Lennart
--
Lennart Poettering, Red Hat
Renjith Vijayan
2017-06-16 08:27:42 UTC
Permalink
Raw Message
Hi Lennart,

I tested this on Systemd v229 & observed this behavior.

Thanks,
RV
Post by Lennart Poettering
Post by Renjith Vijayan
+ Systemd-dev
Hi,
Does journal ignore the forwarding of logs ending with newline(\n) to
rsyslog? In my system there are some logs send directly via
sd_journal_send() API and ending with newline.
These logs are present in journal, but not in /var/log/messages.
Rainer confirmed that rsyslog does accept logs with newline as seen in
mail
Post by Renjith Vijayan
below. So is this the case where journal not forwarding the logs due to
newline?
Note that the behaviour of journald regarding embedded newlines
changed a couple of times in the past. Have you tested this with a
current systemd version?
Lennart
--
Lennart Poettering, Red Hat
Loading...