[systemd-devel] [PATCH] journal: handle multiline syslog messages

[Harald Hoyer]

On 08/06/2013 11:32 AM, Harald Hoyer wrote:
> On 08/05/2013 02:12 PM, Lennart Poettering wrote:
>> On Thu, 01.08.13 12:22, harald at redhat.com (harald at redhat.com) wrote:
>>
>>> From: Harald Hoyer <harald at redhat.com>
>>>
>>> Since the journal can handle multiple lines just well natively,
>>> and rsyslog can be configured to handle them as well, there is no need
>>> to truncate messages from syslog() after the first newline.
>>
>> So, hmm. I am a bit concerned about this as syslog-over-stream 
>> uses NL as a record separator. syslog-over-dgram doesn't need it as
>> record separator, but I am not sure what the various implementations of
>> syslog actually do if they encounter it. We should probably do what
>> the majority of those other implementations do by default as well, for
>> whatever that is...
>>
>>> Reproducer:
>>>
>>> 1. Add following four lines to /etc/rsyslog.conf
>>>
>>>    ----------
>>>    $EscapeControlCharactersOnReceive off
>>>    $ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat
>>>    $SpaceLFOnReceive on
>>>    $DropTrailingLFOnReception off
>>
>> What does rsyslog do by default without these options?
> 
> It just throws away anything after the \n
> 
>>
>>>    ----------
>>>
>>> 3. Restart rsyslog
>>>   # service rsyslog restart
>>>
>>> 4. Compile and run the following program
>>>
>>>    ----------
>>>    #include <stdio.h>
>>>    #include <syslog.h>
>>>
>>>    int main()
>>>    {
>>>     syslog(LOG_INFO, "aaa%caaa", '\n');
>>>     return 0;
>>>    }
>>>    ----------
>>
>> Hmm, what happens if you passs \n inside the static string directly? Why
>> the work-around via %c? How does that change behaviour?
> 
> I just copied the example from the bug report, but you get the same behavior by
> using:
> 
> syslog(LOG_INFO, "aaa\naaa");
> 
>>
>> (I am not against this patch, just trying to figure out the precise implications...)
>>
>> Lennart
>>

pushed upstream