So I've configured my Python application to log to syslog with Python's SysLogHandler, and everything works fine. Except for multi-line handling. Not that I need to emit multiline log records so badly (I do a little), but I need to be able to read Python's exceptions. I'm using Ubuntu with rsyslog 4.2.0. This is what I'm getting:
Mar 28 20:11:59 telemachos root: ERROR 'EXCEPTION'#012Traceback (most recent call last):#012 File "./test.py", line 22, in <module>#012 foo()#012 File "./test.py", line 13, in foo#012 bar()#012 File "./test.py", line 16, in bar#012 bla()#012 File "./test.py", line 19, in bla#012 raise Exception("EXCEPTION!")#012Exception: EXCEPTION!
Test code in case you need it:
import logging from logging.handlers import SysLogHandler logger = logging.getLogger() logger.setLevel(logging.INFO) syslog = SysLogHandler(address='/dev/log', facility='local0') formatter = logging.Formatter('%(name)s: %(levelname)s %(message)r') syslog.setFormatter(formatter) logger.addHandler(syslog) def foo(): bar() def bar(): bla() def bla(): raise Exception("EXCEPTION!") try: foo() except: logger.exception("EXCEPTION")
The TCP multiline syslog protocol is an inbound/passive protocol that uses regular expressions to identify the start and end pattern of multiline events.
Multiline processing is used to ensure a log message that is made up of multiple lines, separated by a line break or carriage return, are properly grouped as a single log message when ingested into Sumo Logic. Multiline processing requires your logs to have line breaks or carriage returns between messages.
The Syslog Format A Syslog message has the following format: A header, followed by structured-data (SD), followed by a message. The header of the Syslog message contains “priority”, “version”, “timestamp”, “hostname”, “application”, “process id”, and “message id”.
Alternatively, if you want to keep your syslog intact on one line for parsing, you can just replace the characters when viewing the log.
tail -f /var/log/syslog | sed 's/#012/\n\t/g'
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With