Syslog Problem Work-Around

Problem

When my Netscreen device logs to a syslog server, the entry lines are all run together. It is like there is no linefeed character at the end of the entry.

Discussion

Link

The industry-standard specifies using the LF character as frame delimiter. Some vendors, notable Juniper in their NetScreen products, use an invalid frame delimiter, in Juniper's case the NUL character.

Work-Around

As indicated in the above link, rsyslog has a work-around in place for it.

I am using syslog-ng. You can define your destination files to have a specific format. Originally I tried adding the linefeed character to the end of the template, but that didn't work because of the nul-terminated string issue. So I decided to put the linefeed at the beginning of the template:

destination messages { file("/var/adm/messages" template("\n$ISODATE $HOST $MSG"));};

This works and it doesn't appear to be filling the log with excessive blank spaces.