[systemd-devel] [PATCH] journal: handle multiline syslog messages

[Lennart Poettering]

On Thu, 01.08.13 12:22, harald at redhat.com (harald at redhat.com) wrote:

> From: Harald Hoyer <harald at redhat.com>
> 
> Since the journal can handle multiple lines just well natively,
> and rsyslog can be configured to handle them as well, there is no need
> to truncate messages from syslog() after the first newline.

So, hmm. I am a bit concerned about this as syslog-over-stream 
uses NL as a record separator. syslog-over-dgram doesn't need it as
record separator, but I am not sure what the various implementations of
syslog actually do if they encounter it. We should probably do what
the majority of those other implementations do by default as well, for
whatever that is...

> Reproducer:
> 
> 1. Add following four lines to /etc/rsyslog.conf
> 
>    ----------
>    $EscapeControlCharactersOnReceive off
>    $ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat
>    $SpaceLFOnReceive on
>    $DropTrailingLFOnReception off

What does rsyslog do by default without these options?

>    ----------
> 
> 3. Restart rsyslog
>   # service rsyslog restart
> 
> 4. Compile and run the following program
> 
>    ----------
>    #include <stdio.h>
>    #include <syslog.h>
> 
>    int main()
>    {
>     syslog(LOG_INFO, "aaa%caaa", '\n');
>     return 0;
>    }
>    ----------

Hmm, what happens if you passs \n inside the static string directly? Why
the work-around via %c? How does that change behaviour?

(I am not against this patch, just trying to figure out the precise implications...)

Lennart

-- 
Lennart Poettering - Red Hat, Inc.