[systemd-devel] [PATCH] journal: handle multiline syslog messages

[Harald Hoyer]

On 08/05/2013 02:12 PM, Lennart Poettering wrote:
> On Thu, 01.08.13 12:22, harald at redhat.com (harald at redhat.com) wrote:
> 
>> From: Harald Hoyer <harald at redhat.com>
>>
>> Since the journal can handle multiple lines just well natively,
>> and rsyslog can be configured to handle them as well, there is no need
>> to truncate messages from syslog() after the first newline.
> 
> So, hmm. I am a bit concerned about this as syslog-over-stream 
> uses NL as a record separator. syslog-over-dgram doesn't need it as
> record separator, but I am not sure what the various implementations of
> syslog actually do if they encounter it. We should probably do what
> the majority of those other implementations do by default as well, for
> whatever that is...
> 
>> Reproducer:
>>
>> 1. Add following four lines to /etc/rsyslog.conf
>>
>>    ----------
>>    $EscapeControlCharactersOnReceive off
>>    $ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat
>>    $SpaceLFOnReceive on
>>    $DropTrailingLFOnReception off
> 
> What does rsyslog do by default without these options?

It just throws away anything after the \n

> 
>>    ----------
>>
>> 3. Restart rsyslog
>>   # service rsyslog restart
>>
>> 4. Compile and run the following program
>>
>>    ----------
>>    #include <stdio.h>
>>    #include <syslog.h>
>>
>>    int main()
>>    {
>>     syslog(LOG_INFO, "aaa%caaa", '\n');
>>     return 0;
>>    }
>>    ----------
> 
> Hmm, what happens if you passs \n inside the static string directly? Why
> the work-around via %c? How does that change behaviour?

I just copied the example from the bug report, but you get the same behavior by
using:

syslog(LOG_INFO, "aaa\naaa");

> 
> (I am not against this patch, just trying to figure out the precise implications...)
> 
> Lennart
>