<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
There is some problem with $PID macro. We experienced this problem on
boot, sometimes $PID macro contain normal string, that can't be
converted to integer, for example : PCI0, LNKA, LNKB, LNKC, LNKD. As I
understand this parameter was read from brackets [], but it isn't
correct in that case. I read RFC document (
<a class="moz-txt-link-freetext"
href="http://tools.ietf.org/html/rfc3164">http://tools.ietf.org/html/rfc3164</a>
) about syslog messages, and I think
the problem occur when syslog-ng parse whole message, but it shouldn't
do this, at least for PID.<br>
I will use the example from RFC document :<br>
<pre> Example 4
<0>1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3
sched[0]: That's All Folks!
</pre>
So as we can see the Log Message is "That's All Folks!" all other text
belong to Log Header. So in that case "sched" is an proccess name and
"0" is a PID of that proccess.<br>
This is our log message : <br>
<pre> Feb 25 18:23:34 test-system kernel: ACPI: PCI Root Bridge [PCI0] (0000:00)</pre>
So here proccess name is "kernel" without PID identifier . As a result
Log Message is "ACPI: PCI Root Bridge [PCI0] (0000:00)". So in that
case PCI0 isn't a PID, but some text in Log Message. The problem is
that we saw "PCI0" in $PID macro which I think must be zero length
string "" or "0".<br>
I use as rule this part of document :<br>
<pre><span class="h3"><a name="section-5.3">5.3</a> Originating Process Information</span>
It has also been considered to be a good practice to include some
information about the process on the device that generated the
message - if that concept exists. This is usually the process name
and process id (often known as the "pid") for robust operating
systems. The process name is commonly displayed in the TAG field.
Quite often, additional information is included at the beginning of
the CONTENT field. The format of "TAG[pid]:" - without the quote
marks - is common. The left square bracket is used to terminate the
TAG field in this case and is then the first character in the CONTENT
field. If the process id is immaterial, it may be left off.
In that case, a colon and a space character usually follow the TAG.
This would be displayed as "TAG: " without the quotes. In that case,
the colon is the first character in the CONTENT field.
</pre>
<div class="moz-signature">-- <br>
<tt>Kostyantyn Gushtin
<br>
Software engineer</tt><br>
<img src="cid:part1.08070201.09030502@n-ix.com.ua" alt="N-iX LLC"><br>
<tt>Solutions for Your success<br>
<a href="http://www.n-ix.com">http://www.n-ix.com</a></tt>
</div>
</body>
</html>