syslog-ng concatanetes messages

Discussion in 'General Linux' started by Gonen Zivav, Apr 27, 2014.

  1. Gonen Zivav

    Gonen Zivav New Member

    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Hello,

    Sometimes syslog-ng combines 2 messages into one line, the second one always preceeded with <PRI>, for example:

    Jan 26 13:13:39 am335x-evm _LTR_[2012]: 52E50A0392CD154C494E4B5F504552494 <141>Jan 26 13:13:39 _LTR_[2012]: 52E50A0392CD154


    First message ends with '2494', using 'vi' it seems that second message starts with '^@' and then the PRI part <141> and then the second message concatanated.

    Thanks,
    Gonen
  2. DevynCJohnson

    DevynCJohnson Well-Known Member Staff Member Staff Writer

    Messages:
    1,138
    Likes Received:
    972
    Trophy Points:
    113
    Are you informing us of this, or would you like a solution? I would recommend using sed to find and replace "2494<141>" with "2494\n<141>". My second choice would be a Python3 script.
  3. Gonen Zivav

    Gonen Zivav New Member

    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Thanks, I really meant to inform it, I would have expect my log files (user.log, daemon.log, etc.) to have each event in a seperate line, here I sometimes get 2 events concatanated, which seems to be a syslog-ng bug..

    Gonen
  4. DevynCJohnson

    DevynCJohnson Well-Known Member Staff Member Staff Writer

    Messages:
    1,138
    Likes Received:
    972
    Trophy Points:
    113

    Perhaps, you should inform the syslog-ng developers.

Share This Page