3

We have implemented centralised logging using syslog-ng on our load balanced servers. The history of that setup can be seen here: How do I set up PHP Logging to go to a remote server? .
It's working fine but the newlines are getting stripped at the destination. Is there any way to keep the newlines intact? Here's our config:

Source 

destination php { tcp("server.com" port(xxxx)); };  
log { source(s_all); filter(f_php); destination(php); };  
filter f_php { facility(user); };

Destination 

destination d_php { file("$PROGRAM" owner(www-data) group(www-data) perm(0644)); };  
filter f_php { program("^\/var\/log\/"); };  
log { source(s_all); filter(f_php); destination(d_php); flags(final); };
Community
  • 1
  • 1
Mohamed Yasin
  • 440
  • 4
  • 10
  • There's another issue that we just discovered. Log messages are getting truncated at 500 characters. This looks like a hard limit in the syslog protocol which might require recompiling from source. We're hoping not to go down that path. Has anyone encountered this before? – Mohamed Yasin Dec 05 '12 at 03:31
  • Just an update for the previous comment. Logs were not getting truncated, rather they were being split every 500 characters. – Mohamed Yasin Dec 13 '12 at 08:51

1 Answers1

0

You can change the syslog template format for the destination and manually add the newline at the end. For example, here's a template I use for one of my customized syslog-ng streams. I change the date format (to be more easily parsed by a script). Notice the "\n" at the end.

file("$PROGRAM"
        template("$R_ISODATE $HOST_FROM $MSGHDR$MSG\n")
        template_escape(no)
);

See the syslog-ng docs for information on the various $VARS you can use.

lifo
  • 2,791
  • 1
  • 25
  • 32