<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Thanks Bazsi, I wasn’t sure if it was me or syslog-ng. <div class="">I will try and get a build server back up this week and test.. </div><div class=""><br class=""></div><div class="">Do you know if Balabit has a nightly build repo to make testing easier ? </div><div class=""><br class=""></div><div class="">Scot </div><div class=""><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 16, 2016, at 6:41 AM, Balazs Scheidler <<a href="mailto:bazsi77@gmail.com" class="">bazsi77@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">This branch should fix your issue: <a href="https://github.com/balabit/syslog-ng/pull/1233" class="">https://github.com/balabit/syslog-ng/pull/1233</a> against current master. Some testing would be appreciated.<br class=""><br class=""></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Oct 14, 2016 at 7:10 PM, Scot Needy <span dir="ltr" class=""><<a href="mailto:scotrn@gmail.com" target="_blank" class="">scotrn@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">That was terrible.<br class="">
<br class="">
I should add that I saw this from a tcpdump.<br class="">
<div class="HOEnZb"><div class="h5"><br class="">
<br class="">
> On Oct 14, 2016, at 10:09 AM, Scot Needy <<a href="mailto:scotrn@gmail.com" class="">scotrn@gmail.com</a>> wrote:<br class="">
><br class="">
> I thou dadd this was from a tcpdump capture.<br class="">
><br class="">
><br class="">
>> On Oct 13, 2016, at 2:07 PM, Scot Needy <<a href="mailto:scotrn@gmail.com" class="">scotrn@gmail.com</a>> wrote:<br class="">
>><br class="">
>> This is strange.<br class="">
>><br class="">
>><br class="">
>> All suppressed messages I see have the Msg date re-written as "Dec 31 23:59:58”. Date never changes.<br class="">
>><br class="">
>><br class="">
>><br class="">
>> Msg: Dec 31 23:59:58 192.168.100.73 Fdm[31436]: Last message '[FFE56B90 verbose 'P' repeated 1 times, suppressed by syslog-ng on<br class="">
><br class="">
<br class="">
______________________________<wbr class="">______________________________<wbr class="">__________________<br class="">
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank" class="">https://lists.balabit.hu/<wbr class="">mailman/listinfo/syslog-ng</a><br class="">
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank" class="">http://www.balabit.com/<wbr class="">support/documentation/?<wbr class="">product=syslog-ng</a><br class="">
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank" class="">http://www.balabit.com/wiki/<wbr class="">syslog-ng-faq</a><br class="">
<br class="">
</div></div></blockquote></div><br class=""><br clear="all" class=""><br class="">-- <br class=""><div class="gmail_signature" data-smartmail="gmail_signature">Bazsi</div>
</div>
______________________________________________________________________________<br class="">Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" class="">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br class="">Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" class="">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br class="">FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" class="">http://www.balabit.com/wiki/syslog-ng-faq</a><br class=""><br class=""></div></blockquote></div><br class=""></div></div></body></html>