<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Book Antiqua";
panose-1:2 4 6 2 5 3 5 3 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Book Antiqua";
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'>Hello,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'>I am currently using Syslog-NG version 2.0rc1.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'>I’ve noticed that sometimes when
Syslog-NG is logging messages, it prefixes something onto the program name
which disrupts filters while matching against a program name. For example, in
some logs for a program named “foo” I’ll see logs in the form
of “<15>foo” which fail to be matched against a filter of ‘program(“foo”)
‘. This seems to only be noticed on logs which originate from remote
hosts.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'>Could anyone provide an explanation for what
is going on with this?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'>Regards,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Book Antiqua"><span style='font-size:
10.0pt;font-family:"Book Antiqua"'>Justin Randall<o:p></o:p></span></font></p>
</div>
</body>
</html>