Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Multiline log records in syslog

So I've configured my Python application to log to syslog with Python's SysLogHandler, and everything works fine. Except for multi-line handling. Not that I need to emit multiline log records so badly (I do a little), but I need to be able to read Python's exceptions. I'm using Ubuntu with rsyslog 4.2.0. This is what I'm getting:

Mar 28 20:11:59 telemachos root: ERROR 'EXCEPTION'#012Traceback (most recent call last):#012  File "./test.py", line 22, in <module>#012    foo()#012  File "./test.py", line 13, in foo#012    bar()#012  File "./test.py", line 16, in bar#012    bla()#012  File "./test.py", line 19, in bla#012    raise Exception("EXCEPTION!")#012Exception: EXCEPTION! 

Test code in case you need it:

import logging from logging.handlers import SysLogHandler  logger = logging.getLogger() logger.setLevel(logging.INFO) syslog = SysLogHandler(address='/dev/log', facility='local0') formatter = logging.Formatter('%(name)s: %(levelname)s %(message)r') syslog.setFormatter(formatter) logger.addHandler(syslog)  def foo():     bar()  def bar():     bla()  def bla():     raise Exception("EXCEPTION!")  try:     foo() except:     logger.exception("EXCEPTION") 
like image 873
Shay Rojansky Avatar asked Mar 28 '11 19:03

Shay Rojansky


People also ask

What is multiline syslog?

The TCP multiline syslog protocol is an inbound/passive protocol that uses regular expressions to identify the start and end pattern of multiline events.

What is multiline logging?

Multiline processing is used to ensure a log message that is made up of multiple lines, separated by a line break or carriage return, are properly grouped as a single log message when ingested into Sumo Logic. Multiline processing requires your logs to have line breaks or carriage returns between messages.

What is syslog format?

The Syslog Format A Syslog message has the following format: A header, followed by structured-data (SD), followed by a message. The header of the Syslog message contains “priority”, “version”, “timestamp”, “hostname”, “application”, “process id”, and “message id”.


1 Answers

Alternatively, if you want to keep your syslog intact on one line for parsing, you can just replace the characters when viewing the log.

tail -f /var/log/syslog | sed 's/#012/\n\t/g' 
like image 134
Nick Zalutskiy Avatar answered Sep 23 '22 15:09

Nick Zalutskiy