Message278417
After reading the RFC5424 it seems that there is no such "new line message delimiter":
--------------------------------
4.3.1. Message Length
The message length is the octet count of the SYSLOG-MSG in the
SYSLOG-FRAME. A transport receiver MUST use the message length to delimit a syslog message
--------------------------------
So I think it must be a Fluentd error. This is what caused my confusion:
From in_syslog.rb (https://github.com/athenahealth/fluent-plugin-newsyslog/blob/master/lib/fluent/plugin/in_newsyslog.rb):
--------------------------------
# syslog family add "\n" to each message and this seems only way to split messages in tcp stream
Coolio::TCPServer.new(@bind, @port, SocketUtil::TcpHandler, log, "\n", callback)
-------------------------------- |
|
Date |
User |
Action |
Args |
2016-10-10 14:43:26 | elelement | set | recipients:
+ elelement |
2016-10-10 14:43:26 | elelement | set | messageid: <1476110606.71.0.15020812007.issue28404@psf.upfronthosting.co.za> |
2016-10-10 14:43:26 | elelement | link | issue28404 messages |
2016-10-10 14:43:26 | elelement | create | |
|