<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#0050d0">
<font size="-1"><font face="Helvetica, Arial, sans-serif">Well to be
fair, hostnames that start with a number are a violation of RFC 952.<br>
<a class="moz-txt-link-freetext" href="http://www.ietf.org/rfc/rfc952.txt">http://www.ietf.org/rfc/rfc952.txt</a><br>
"The first character must be an alpha character"<br>
</font></font><br>
-Patrick<br>
<br>
<br>
Sent: Tue Dec 07 2010 16:49:03 GMT-0700 (Mountain Standard Time)<br>
From: <a class="moz-txt-link-abbreviated" href="mailto:bugzilla@bugzilla.balabit.com">bugzilla@bugzilla.balabit.com</a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] [Bug 100] New: Hostnames that start with 4+ digits
mess up the time system
<blockquote cite="mid:bug-100-3@https.bugzilla.balabit.com%2F"
type="cite">
<pre wrap=""><a class="moz-txt-link-freetext" href="https://bugzilla.balabit.com/show_bug.cgi?id=100">https://bugzilla.balabit.com/show_bug.cgi?id=100</a>
Summary: Hostnames that start with 4+ digits mess up the time
system
Product: syslog-ng
Version: 2.0.x
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: unspecified
Component: syslog-ng
AssignedTo: <a class="moz-txt-link-abbreviated" href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>
ReportedBy: <a class="moz-txt-link-abbreviated" href="mailto:D.Ojalvo@f5.com">D.Ojalvo@f5.com</a>
Type of the Report: ---
Estimated Hours: 0.0
Created an attachment (id=26)
--> (<a class="moz-txt-link-freetext" href="https://bugzilla.balabit.com/attachment.cgi?id=26">https://bugzilla.balabit.com/attachment.cgi?id=26</a>)
My patch proposal
If syslog is handling a message with an rfc 3164-type timestamp then a hostname that begins with 4 digits,
the time parser will mess up because it thinks that it is dealing with a linksys-style timestamp that includes the year,
when the rfc3164 timestamp does not. I wrote a patch that adds a strict rfc3164 parsing option to the syslog startup.
</pre>
</blockquote>
</body>
</html>