<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000066">
Sent: Fri Nov 25 2011 05:21:38 GMT-0700 (MST)<br>
From: Balazs Scheidler <a class="moz-txt-link-rfc2396E" href="mailto:bazsi@balabit.hu"><bazsi@balabit.hu></a><br>
To: Syslog-ng users' and developers' mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a> <br>
Subject: Re: [syslog-ng] Multi-threaded in open source?
<blockquote cite="mid:1322223698.9800.71.camel@bzorp" type="cite">
<pre wrap="">On Fri, 2011-11-25 at 05:12 -0700, Patrick H. wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Sent: Fri Nov 25 2011 05:04:01 GMT-0700 (MST)
From: Balazs Scheidler <a class="moz-txt-link-rfc2396E" href="mailto:bazsi@balabit.hu"><bazsi@balabit.hu></a>
To: Syslog-ng users' and developers' mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a>
Subject: Re: [syslog-ng] Multi-threaded in open source?
</pre>
<blockquote type="cite">
<pre wrap="">On Fri, 2011-11-18 at 19:52 -0700, Patrick H. wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Yes, the 3.3 branch supports threading. Note though that 3.3 hasnt had
a great track record so far (lots of bugs). However 3.3.3 might be
stable enough for production use.
</pre>
</blockquote>
<pre wrap="">The track record is true enough, however the positive feedback has
started too. So at least give it a try, send feedback and fall back to
older in case an issue happens.
I only had a single 3.3.x fix ever since 3.3.3, which is more than a
week old now :)
</pre>
</blockquote>
<pre wrap="">
Actually I have found a bug in 3.3.3, I just havent had time to go
track it down.
I ran into a case where I had a filter that was setting a macro called
'FEXT' which I was using in a file destination for the filename
extension. However it was acting as if the FEXT macro didnt exist at
all (as filenames had no extension) and the message text was replaced
with the contents of the FEXT macro. I downgraded syslog-ng to 3.2.4
with the exact same config (except with the threading config option
removed) and it behaved as expected there.
</pre>
</blockquote>
<pre wrap="">
I've just applied a patch for a rewrite specific issue: in case a
rewrite rule was used from multiple locations, then some of the
references fell back to using $MESSAGE instead of the value specified.
Can you post your filter/rewrite rule that is not seemingly applied?
Thanks.
</pre>
</blockquote>
Youre good. I applied the logrewrite.c patch and the issue is gone.<br>
Thanks. I'll try not to break anything else for a while :-)<br>
</body>
</html>