<div dir="ltr">The following blogpost might help you to test the patch: <a href="https://syslog-ng.com/blog/build-syslog-ng-rpm-patched-git-sources-rhel-centos-7/">https://syslog-ng.com/blog/build-syslog-ng-rpm-patched-git-sources-rhel-centos-7/</a></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 19, 2018 at 1:57 PM, Nagy, Gábor <span dir="ltr"><<a href="mailto:gabor.nagy@balabit.com" target="_blank">gabor.nagy@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello Don!<div><br></div><div>We did have a regression in kv-parser, it has been fixed recently, merged to upstream and it will be in the upcoming syslog-ng release 3.14.1.<br>You can find the patch here: <a href="https://github.com/balabit/syslog-ng/commit/aba5d41c1f092981501e75f009ffffee76fc77ea" target="_blank">https://github.com/balabit/<wbr>syslog-ng/commit/<wbr>aba5d41c1f092981501e75f009ffff<wbr>ee76fc77ea</a><br></div><div><br></div><div>Best Regards,</div><div>Gabor<br><br></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Thu, Jan 25, 2018 at 6:37 PM, Don C <span dir="ltr"><<a href="mailto:lawsuit_loser@yahoo.com" target="_blank">lawsuit_loser@yahoo.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div><div style="font-family:Helvetica Neue,Helvetica,Arial,sans-serif;font-size:13px"><div>Hi,</div><div><br></div><div>I was upgrading syslog-ng from 3.12 to 3.13 using the prebuilt unofficial RPMs.<br></div><div>I was testing my config on 3.13 and ran into the following issue where the key-value parsing aborts.</div><div>This appears to be a regression in 3.13, the abort never happened in 3.12.<br></div><div><br></div><div>If I remove the kv_parser from my config, there is no issue.<br></div><div><br></div><div>Here's the end of the debug and verbose output I get. Notice the garbage values in the key-value names parsed from the message.<br></div><div><br></div><div>[2018-01-25T17:33:08.924895] Filter rule evaluation result; msg='0x7fc0a807b370', result='match', rule='f_compliant_hosts', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:66:27' <br>[2018-01-25T17:33:08.924919] Setting value; msg='0x7fc0a80612f0', name='@\x15\x01pÀ', value='2017-11-21 19:11:24.817041' <wbr> <wbr> <br>[2018-01-25T17:33:08.924930] Setting value; msg='0x7fc0a80612f0', name='', value='debug' <wbr> <wbr> <wbr> <br>[2018-01-25T17:33:08.924936] Setting value; msg='0x7fc0a80612f0', name='f_compliant_hosts', value='[robotnats kafka transport prepared]' <wbr> <br>[2018-01-25T17:33:08.924944] Setting value; msg='0x7fc0a80612f0', name='PK\x06¨À', value='ROBOT_serviceTracking_n<wbr>eo4j-topo-svc-2717019760-1sdn1<wbr>' <br>[2018-01-25T17:33:08.924952] Setting value; msg='0x7fc0a80612f0', name='', value='nats://nats:4222' <wbr> <wbr> <wbr> <br>[2018-01-25T17:33:08.924957] Setting value; msg='0x7fc0a80612f0', name='', value='[robot-kafka:9092]' <wbr> <wbr> <wbr> <br>[2018-01-25T17:33:08.924963] Setting value; msg='0x7fc0a80612f0', name='kv_kafka', value='robotnats_kafka' <wbr> <wbr> <br>[2018-01-25T17:33:08.924969] Setting value; msg='0x7fc0a80612f0', name=' »\x08¬À', value='ROBOT_serviceTracking_n<wbr>eo4j-topo-svc-2717019760-1sdn1<wbr>' <br>[2018-01-25T17:33:08.924975] Message parsing complete; result='1', rule='p_kv', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:75:5' <wbr> <wbr> <br>[2018-01-25T17:33:08.924998] Incoming log entry; line='time="2017-11-21 19:11:24.817095" level=info msg="[skeleton core configuration parse stage complete]" config=/etc/robot/servicetrack<wbr>ing.conf debug=true logfile= maxthreads=16 tag=ROBOT_serviceTracking_neo4<wbr>j-topo-svc-2717019760-1sdn1 version=' <wbr> <br>[2018-01-25T17:33:08.925030] Setting value; msg='0x7fc0a807bd60', name='MESSAGE', value='time="2017-11-21 19:11:24.817095" level=info msg="[skeleton core configuration parse stage complete]" config=/etc/robot/servicetrack<wbr>ing.conf debug=true logfile= maxthreads=16 tag=ROBOT_serviceTracking_neo4<wbr>j-topo-svc-2717019760-1sdn1 version=' <br>[2018-01-25T17:33:08.925040] Setting value; msg='0x7fc0a807bd60', name='HOST_FROM', value='syslog-ng-logging-10401<wbr>68119-qsmrf' <wbr> <br>[2018-01-25T17:33:08.925046] Setting value; msg='0x7fc0a807bd60', name='HOST', value='syslog-ng-logging-10401<wbr>68119-qsmrf/syslog-ng-logging-<wbr>1040168119-qsmrf' <wbr> <br>[2018-01-25T17:33:08.925053] Setting value; msg='0x7fc0a807bd60', name='FILE_NAME', value='/mnt/logfs/neo4j-topo-s<wbr>vc/1/servicetracking_stdout.lo<wbr>g' <br>[2018-01-25T17:33:08.925057] Setting value; msg='0x7fc0a807bd60', name='SOURCE', value='s_file_stdout' <wbr> <wbr> <br>[2018-01-25T17:33:08.925062] Requesting flow control; location='/etc/syslog-ng/syslo<wbr>g-ng.conf:81:5' <wbr> <wbr> <br>[2018-01-25T17:33:08.824606] Incoming log entry; line='time="2017-11-21 19:10:56.399341" level=debug msg="[section not required]" section=etcd tag=ROBOT_serviceTracking_robo<wbr>t-topo-svc-<a href="tel:(210)%20732-1943" value="+12107321943" target="_blank">2107321943</a>-48rnw' <wbr> <wbr> <wbr> <wbr> <wbr> <br>[2018-01-25T17:33:09.022629] Filter rule evaluation begins; msg='0x7fc0a807bd60', rule='f_compliant_hosts', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:66:27' <wbr> <br>[2018-01-25T17:33:08.824700] Setting value; msg='0x7fc0a409b810', name='HOST_FROM', value='syslog-ng-logging-10401<wbr>68119-qsmrf' <wbr> <br># <wbr> <wbr> <wbr> <wbr> <wbr> <br># If you would like to submit a bug report, please visit: <wbr> <wbr> <wbr> <br># <a href="http://bugreport.java.com/bugreport/crash.jsp" target="_blank">http://bugreport.java.com/bugr<wbr>eport/crash.jsp</a> <wbr> <wbr> <wbr> <wbr> <br># The crash happened outside the Java Virtual Machine in native code. <wbr> <wbr> <wbr> <br># See problematic frame for where to report the bug. <wbr> <wbr> <wbr> <wbr> <br># <wbr> <wbr> <wbr> <wbr> <wbr> <br>... <wbr> <br>[2018-01-25T17:33:09.022911] Requesting flow control; location='/etc/syslog-ng/syslo<wbr>g-ng.conf:81:5' <wbr> <wbr> <br>[2018-01-25T17:33:09.022916] Filter rule evaluation begins; msg='0x7fc08c0f5550', rule='f_compliant_hosts', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:66:27' <wbr> <br>[2018-01-25T17:33:09.022922] Filter node evaluation result; msg='0x7fc08c0f5550', result='not-match', type='==' <wbr> <wbr> <br>[2018-01-25T17:33:09.022927] Filter rule evaluation result; msg='0x7fc08c0f5550', result='not-match', rule='f_compliant_hosts', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:66:27' <wbr> <wbr> <wbr> <wbr> <wbr> <wbr> <br>[2018-01-25T17:33:09.022932] Filter rule evaluation begins; msg='0x7fc08c0f5550', rule='f_noncompliant_hosts', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:70:30' <br>[2018-01-25T17:33:09.022937] Filter node evaluation result; msg='0x7fc08c0f5550', result='not-match', type='=='<br>[2018-01-25T17:33:09.022942] Filter node evaluation result; msg='0x7fc08c0f5550', result='match', type='filter(f_compliant_hosts<wbr>)'<br>[2018-01-25T17:33:09.022947] Filter rule evaluation result; msg='0x7fc08c0f5550', result='match', rule='f_noncompliant_hosts', location='/etc/syslog-ng/syslo<wbr>g-ng.conf:70:30'<br>Aborted<br><div><br></div><div>Is this a known issue with the key-value parser in 3.13?<br></div><div><br></div><div>Regards,<br></div>Don<br></div><div><br><div><br></div><div><br></div><div><br></div></div></div></div><br></div></div>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>