<br><font size=2 face="sans-serif">Hi,</font>
<br>
<br><font size=2 face="sans-serif">I'm trying to test syslog-ng under HP-UX
11iv2 (both PA-RISC and IA64) to use as an alternative to the supplied
syslogd.</font>
<br>
<br><font size=2 face="sans-serif">I have tried using the precompiled 3.0.5
binaries supplied with HP's DSAU (Distributed Systems Administration Utilities)
pack, as well as compiling 3.0.5 and also version 3.1.2 from source. In
all 3 cases I have the same problem; it seems to be attempting to process
the padded data remaining in the 2048-byte chunk that is read from /dev/log,
as you can see from the test below. In other words it does not stop
processing the 2048-byte chunk of data when it reaches the first null byte.
This means that the first log entry after startup is processed correctly,
but then all sorts of random things start to happen, including blank (other
than date stamp and host name) messages to every connected terminal.</font>
<br>
<br><font size=2 face="sans-serif">I used gcc-3.4.3, glib-2.24.2, popt
1.16, and pkgconfig 0.25 from the HP-UX Porting and Archive Centre to compile
it.</font>
<br>
<br><font size=2 face="sans-serif">Have I overlooked something obvious
here? I can't see any other similar reports on this mailing list
or in the wild.</font>
<br>
<br><font size=2 face="sans-serif">I'd appreciate any suggestions! Regards,</font>
<br>
<br><font size=2 face="sans-serif">Scott.</font>
<br>
<br><font size=2 face="sans-serif">P.S. It's a little confusing that the
HP-UX notes in the INSTALL file and the contrib/syslog-ng.conf.HP-UX files
disagree with each other about the source syntax; will these be reconciled
in a future release?</font>
<br>
<br><font size=2 face="sans-serif"># nohup /usr/local/sbin/syslog-ng --debug
--foreground --stderr > syslog-ng.out 2>&1 &</font>
<br><font size=2 face="sans-serif"># logger -p user.notice "a user.notice
test"</font>
<br><font size=2 face="sans-serif"># grep Incoming syslog-ng.out | head</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='<13>Sep
6 05:16:52 syslog: a user.notice test'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='L\x84yD'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='\x01'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='\x01'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='\x01'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='\x09'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='\x01\x90T'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='\xd1\x9d'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='h\x0f\x1c,h\x0f\x1c\x98@'</font>
<br><font size=2 face="sans-serif">Incoming log entry; line='[Hh\x0dG\xc4h\x0dG\xc4\xc0\x1d?K\xc0\x1d?\x93'</font>
<br><font size=2 face="sans-serif"># /usr/local/sbin/syslog-ng -V</font>
<br><font size=2 face="sans-serif">syslog-ng 3.1.2</font>
<br><font size=2 face="sans-serif">Installer-Version: 3.1.2</font>
<br><font size=2 face="sans-serif">Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca</font>
<br><font size=2 face="sans-serif">Compile-Date: Sep 6 2010 01:21:23</font>
<br><font size=2 face="sans-serif">Enable-Threads: off</font>
<br><font size=2 face="sans-serif">Enable-Debug: off</font>
<br><font size=2 face="sans-serif">Enable-GProf: off</font>
<br><font size=2 face="sans-serif">Enable-Memtrace: off</font>
<br><font size=2 face="sans-serif">Enable-Sun-STREAMS: off</font>
<br><font size=2 face="sans-serif">Enable-Sun-Door: off</font>
<br><font size=2 face="sans-serif">Enable-IPv6: on</font>
<br><font size=2 face="sans-serif">Enable-Spoof-Source: off</font>
<br><font size=2 face="sans-serif">Enable-TCP-Wrapper: on</font>
<br><font size=2 face="sans-serif">Enable-SSL: on</font>
<br><font size=2 face="sans-serif">Enable-SQL: off</font>
<br><font size=2 face="sans-serif">Enable-Linux-Caps: off</font>
<br><font size=2 face="sans-serif">Enable-Pcre: off</font>
<br><font size=2 face="sans-serif"># cat /usr/local/etc/syslog-ng.conf</font>
<br><font size=2 face="sans-serif">@version: 3.0</font>
<br><font size=2 face="sans-serif"># syslog-ng configuration file.</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif"># This should behave pretty much like
the original syslog on HP-UX. But</font>
<br><font size=2 face="sans-serif"># it could be configured a lot smarter.</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif"># See syslog-ng(8) and syslog-ng.conf(8)
for more information.</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif"># 20000925 gb@sysfive.com</font>
<br>
<br><font size=2 face="sans-serif">options { time_reopen (10);</font>
<br><font size=2 face="sans-serif"> log_fifo_size
(1000);</font>
<br><font size=2 face="sans-serif"> long_hostnames
(off);</font>
<br><font size=2 face="sans-serif"> use_dns
(no);</font>
<br><font size=2 face="sans-serif"> use_fqdn
(no);</font>
<br><font size=2 face="sans-serif"> create_dirs
(no);</font>
<br><font size=2 face="sans-serif"> keep_hostname
(yes);</font>
<br><font size=2 face="sans-serif"> };</font>
<br>
<br><font size=2 face="sans-serif"># default contrib'd version</font>
<br><font size=2 face="sans-serif"># source s_sys { pipe("/dev/log");
internal(); };</font>
<br>
<br><font size=2 face="sans-serif"># recommended by INSTALL</font>
<br><font size=2 face="sans-serif">source s_sys { pipe("/dev/log"
pad_size(2048)); };</font>
<br>
<br><font size=2 face="sans-serif">destination d_cons { file("/dev/console");
};</font>
<br><font size=2 face="sans-serif">destination d_mesg { file("/var/adm/syslog/syslog.log");
};</font>
<br><font size=2 face="sans-serif">destination d_mail { file("/var/adm/syslog/mail.log");
};</font>
<br><font size=2 face="sans-serif">destination d_mlrt { usertty("root");
};</font>
<br><font size=2 face="sans-serif">destination d_mlal { usertty("*");
};</font>
<br>
<br><font size=2 face="sans-serif">filter f_filter1 { facility(mail)
and level(debug); };</font>
<br><font size=2 face="sans-serif">filter f_filter2 { (facility(mail)
and level(debug)) or</font>
<br><font size=2 face="sans-serif">
level(info); };</font>
<br><font size=2 face="sans-serif">filter f_filter3 { level(alert);
};</font>
<br><font size=2 face="sans-serif">filter f_filter4 { level(emerg);
};</font>
<br>
<br><font size=2 face="sans-serif">log { source(s_sys); filter(f_filter1);
destination(d_mail); };</font>
<br><font size=2 face="sans-serif">log { source(s_sys); filter(f_filter2);
destination(d_mesg); };</font>
<br><font size=2 face="sans-serif">log { source(s_sys); filter(f_filter3);
destination(d_cons);</font>
<br><font size=2 face="sans-serif">
destination(d_mlrt); };</font>
<br><font size=2 face="sans-serif">log { source(s_sys); filter(f_filter4);
destination(d_mlal); };</font>
<br><font size=2 face="sans-serif">#<br>
<br>
<br>
<br>
</font>