You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi All,
I'm having an issue with multi-line-* running on a network source. When running multi-line-* on a file as source this works fine but not through the network as a source.
Any help would greatly appreciated as the specific device I am having issues with doesn't seem to fix with no-multi-line as flags and would need the availability of utilizing regex on the network stack.
Example of a non working Networking Source:
source hosts {
network(port(1999)
transport("tcp")
multi-line-mode("regexp")
multi-line-prefix("[0-9]{4}.[0-9]{2}.[0-9]{2}.")
flags(no-parse,no-multi-line,validate-utf8));
};
destination logs
{
file("/opt/data/syslogs/michael_test/${HOST}.log"
create_dirs(yes) dir_owner("elkuser") dir_group("users") dir_perm(0700)
owner("elkuser") group("users") perm(0600)
#template("${RCPTID}--$FACILITY--$PRIORITY--$FULLHOST--$PROGRAM--$ISODATE--${MSGHDR}${MESSAGE}\n")
template("${ISODATE} ${HOST} $(indent-multi-line ${MESSAGE})\n")
);
}
Example of a WORKING file source with multi-line-:
source s_multiline {
file("/path/to/file" multi-line-mode(regexp)
multi-line-prefix("^prefix")
multi-line-garbage(" garbage$"));
};
Version of syslog-ng
syslog-ng 3 (3.12.1)
Installer-Version: 3.12.1
Revision:
Compile-Date: Nov 3 2017 12:59:16
Module-Directory: /usr/local/lib/syslog-ng
Module-Path: /usr/local/lib/syslog-ng
Available-Modules: syslogformat,afsocket,affile,afprog,afuser,afamqp,afmongodb,csvparser,confgen,system-source,linux-kmsg-format,basicfuncs,cryptofuncs,dbparser,json-plugin,afstomp,pseudofile,graphite,sdjournal,kvformat,date,cef,disk-buffer,add-contextual-data,tfgetent,map-value-pairs,stardate,snmptrapd-parser,tags-parser,xml
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: off
Enable-Linux-Caps: off
Enable-Systemd: off
Platform
Red Hat Enterprise Linux Server release 7.3 (Maipo)
Debug bundle
Create a debug bundle on your system with the syslog-ng-debun script which is included in the syslog-ng package.
Overwiew of the CLI options of syslog-ng-debun:
-r: run actual information gathering
-d: run syslog-ng in debug mode
-p: perform packet capture
-s: do strace
-t: timeout period for running debug/pcap/strace
-w: wait period before starting debug mode
-l: light information gathering (respects privacy)
-R: alternate installation directory for syslog-ng
$ syslog-ng-debun -r
Issue
With any multi-line-* on Network as a source E.G multi-line-mode, multi-line-prefix will not work.
Failure
Steps to reproduce
[2017-11-08T18:07:43.291160] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.12 format at your time of convenience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @Version header at the top of the configuration file.;
Error parsing afsocket, syntax error, unexpected LL_IDENTIFIER, expecting KW_NORMALIZE_HOSTNAMES or KW_USE_DNS or KW_USE_FQDN or KW_DNS_CACHE in /etc/syslog-ng/syslog-ng.conf at line 33, column 11:
Hi All,
I'm having an issue with multi-line-* running on a network source. When running multi-line-* on a file as source this works fine but not through the network as a source.
Any help would greatly appreciated as the specific device I am having issues with doesn't seem to fix with no-multi-line as flags and would need the availability of utilizing regex on the network stack.
Example of a non working Networking Source:${HOST} $ (indent-multi-line ${MESSAGE})\n")
source hosts {
network(port(1999)
transport("tcp")
multi-line-mode("regexp")
multi-line-prefix("[0-9]{4}.[0-9]{2}.[0-9]{2}.")
flags(no-parse,no-multi-line,validate-utf8));
};
destination logs
{
file("/opt/data/syslogs/michael_test/${HOST}.log"
create_dirs(yes) dir_owner("elkuser") dir_group("users") dir_perm(0700)
owner("elkuser") group("users") perm(0600)
#template("${RCPTID}--$FACILITY--$PRIORITY--$FULLHOST--$PROGRAM--$ISODATE--${MSGHDR}${MESSAGE}\n")
template("${ISODATE}
);
}
Example of a WORKING file source with multi-line-:
source s_multiline {
file("/path/to/file" multi-line-mode(regexp)
multi-line-prefix("^prefix")
multi-line-garbage(" garbage$"));
};
Version of syslog-ng
syslog-ng 3 (3.12.1)
Installer-Version: 3.12.1
Revision:
Compile-Date: Nov 3 2017 12:59:16
Module-Directory: /usr/local/lib/syslog-ng
Module-Path: /usr/local/lib/syslog-ng
Available-Modules: syslogformat,afsocket,affile,afprog,afuser,afamqp,afmongodb,csvparser,confgen,system-source,linux-kmsg-format,basicfuncs,cryptofuncs,dbparser,json-plugin,afstomp,pseudofile,graphite,sdjournal,kvformat,date,cef,disk-buffer,add-contextual-data,tfgetent,map-value-pairs,stardate,snmptrapd-parser,tags-parser,xml
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: off
Enable-Linux-Caps: off
Enable-Systemd: off
Platform
Red Hat Enterprise Linux Server release 7.3 (Maipo)
Debug bundle
Create a debug bundle on your system with the syslog-ng-debun script which is included in the syslog-ng package.
Overwiew of the CLI options of syslog-ng-debun:
-r: run actual information gathering
-d: run syslog-ng in debug mode
-p: perform packet capture
-s: do strace
-t: timeout period for running debug/pcap/strace
-w: wait period before starting debug mode
-l: light information gathering (respects privacy)
-R: alternate installation directory for syslog-ng
Issue
With any multi-line-* on Network as a source E.G multi-line-mode, multi-line-prefix will not work.
Failure
Steps to reproduce
[2017-11-08T18:07:43.291160] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.12 format at your time of convenience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @Version header at the top of the configuration file.;
Error parsing afsocket, syntax error, unexpected LL_IDENTIFIER, expecting KW_NORMALIZE_HOSTNAMES or KW_USE_DNS or KW_USE_FQDN or KW_DNS_CACHE in /etc/syslog-ng/syslog-ng.conf at line 33, column 11:
syslog-ng documentation: https://www.balabit.com/support/documentation?product=syslog-ng-ose
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Configuration
This is pretty much a default config to display the issue at hand
(or gist URL)
Input and output logs (if possible)
The text was updated successfully, but these errors were encountered: