{"id":3531,"date":"2017-08-12T20:27:47","date_gmt":"2017-08-12T12:27:47","guid":{"rendered":"https:\/\/ixyzero.com\/blog\/?p=3531"},"modified":"2017-08-12T20:27:47","modified_gmt":"2017-08-12T12:27:47","slug":"linux%e4%b8%adrsyslog%e7%9a%84012%e9%97%ae%e9%a2%98","status":"publish","type":"post","link":"https:\/\/ixyzero.com\/blog\/archives\/3531.html","title":{"rendered":"Linux\u4e2d[r]syslog\u7684#012\u95ee\u9898"},"content":{"rendered":"<p>=Start=<\/p>\n<h4 id=\"Linux\u4e2dsyslog\u7684#012\u95ee\u9898-\u7f18\u7531\">\u7f18\u7531\uff1a<\/h4>\n<p>\u5728\u4f7f\u7528[r]syslog\u65f6\uff0c\u53d1\u73b0\u4e86\u4e00\u4e2a\u6bd4\u8f83\u602a\u5f02\u7684\u95ee\u9898\uff0c\u65e5\u5fd7\u4e2d\u6709\u300c#012\u300d\u8fd9\u6837\u7684\u5b57\u7b26\uff0c\u4f46\u662f\u6211\u4e4b\u524d\u5728\u64cd\u4f5c\u7684\u65f6\u5019\u660e\u660e\u6ca1\u6709\u53d1\u9001\/\u6253\u5370\u300c#012\u300d\u554a\uff1f\u8fd8\u6709\u5c31\u662f\uff0c\u6211\u7684\u6362\u884c\u7b26\u54ea\u53bb\u4e86\uff1f\uff1f\uff1f<\/p>\n<h4 id=\"Linux\u4e2dsyslog\u7684#012\u95ee\u9898-\u5185\u5bb9\">\u6b63\u6587\uff1a<\/h4>\n<h5>\u53c2\u8003\u89e3\u7b54\uff1a<\/h5>\n<p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b rsyslog \u4f1a\u5c06&#8221;\u602a\u5f02\u7684&#8221;\u5b57\u7b26(ASCII &lt; 32)\u8fdb\u884c\u8f6c\u4e49\uff0c\u8fd9\u5176\u4e2d\u5c31\u5305\u62ec\u4e86\u6362\u884c\u7b26(\\n)\u3001\u5236\u8868\u7b26(\\t)\u7b49\u7b26\u53f7\uff0c\u5982\u679c\u4f60\u4e0d\u5e0c\u671brsyslog\u81ea\u52a8\u8fdb\u884c\u8f6c\u4e49\uff0c\u53ef\u4ee5\u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u8fdb\u884c\u4fee\u6539\u3002rsyslog by default escapes all weird characters (ASCII &lt; 32), and this include newlines (as well as tabs and others). Simply add this to your rsyslog config to turn this off:<\/p>\n<div class=\"code panel pdl conf-macro output-block\" data-hasbody=\"true\" data-macro-name=\"code\">\n<div class=\"codeContent panelContent pdl\">\n<div>\n<div id=\"highlighter_239256\" class=\"syntaxhighlighter sh-confluence nogutter java\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"code\">\n<div class=\"container\" title=\"Hint: double-click to select code\">\n<div class=\"line number1 index0 alt2\"><code class=\"java plain\">$EscapeControlCharactersOnReceive off<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>\u53e6\u4e00\u79cd\u53ef\u9009\u7684\u65b9\u6cd5\u5c31\u662f\u2014\u2014\u4fdd\u6301syslog\u7684\u5b8c\u6574\u6027\uff0c\u53ea\u5728\u5206\u6790\u65e5\u5fd7\u7684\u65f6\u5019\u5bf9\u7279\u6b8a\u5b57\u7b26\u8fdb\u884c\u66ff\u6362\u3002Alternatively, if you want to keep your syslog intact on one line for parsing, you can just replace the characters when viewing the log:<\/p>\n<div class=\"code panel pdl conf-macro output-block\" data-hasbody=\"true\" data-macro-name=\"code\">\n<div class=\"codeContent panelContent pdl\">\n<div>\n<div id=\"highlighter_404221\" class=\"syntaxhighlighter sh-confluence nogutter java\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"code\">\n<div class=\"container\" title=\"Hint: double-click to select code\">\n<div class=\"line number1 index0 alt2\"><code class=\"java plain\">tail -f \/var\/log\/syslog | sed\u00a0<\/code><code class=\"java string\">'s\/#012\/\\n\\t\/g'<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><code class=\"java plain\">tail -f \/var\/log\/syslog | perl -pe\u00a0<\/code><code class=\"java string\">'s\/#012\/\\n\\t\/g;'<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h4 id=\"Linux\u4e2dsyslog\u7684#012\u95ee\u9898-\u53c2\u8003\u94fe\u63a5\">\u53c2\u8003\u94fe\u63a5\uff1a<\/h4>\n<ul>\n<li><a class=\"external-link\" href=\"http:\/\/stackoverflow.com\/questions\/5463992\/multiline-log-records-in-syslog\" rel=\"nofollow\">http:\/\/stackoverflow.com\/questions\/5463992\/multiline-log-records-in-syslog<\/a><\/li>\n<li><a class=\"external-link\" href=\"https:\/\/lists.debian.org\/debian-user\/2008\/09\/msg00136.html\" rel=\"nofollow\">https:\/\/lists.debian.org\/debian-user\/2008\/09\/msg00136.html<\/a><\/li>\n<li><a class=\"external-link\" href=\"http:\/\/naonao.blog.51cto.com\/1135983\/1556842\" rel=\"nofollow\">http:\/\/naonao.blog.51cto.com\/1135983\/1556842<\/a><\/li>\n<\/ul>\n<p>=END=<\/p>\n","protected":false},"excerpt":{"rendered":"<p>=Start= \u7f18\u7531\uff1a \u5728\u4f7f\u7528[r]syslog\u65f6\uff0c\u53d1\u73b0\u4e86\u4e00\u4e2a\u6bd4\u8f83\u602a\u5f02\u7684\u95ee\u9898\uff0c\u65e5\u5fd7\u4e2d\u6709\u300c#012\u300d\u8fd9\u6837\u7684\u5b57\u7b26\uff0c [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,11,12],"tags":[912,30,692],"class_list":["post-3531","post","type-post","status-publish","format-standard","hentry","category-knowledgebase-2","category-linux","category-tools","tag-912","tag-linux","tag-rsyslog"],"views":8860,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=3531"}],"version-history":[{"count":2,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3531\/revisions"}],"predecessor-version":[{"id":3537,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3531\/revisions\/3537"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=3531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=3531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=3531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}