Hi all - We're seeing some weird behavior on our central loghosts. Could be config, I suppose, but it seems unusual and I don't see config issue causing it. The summary is that we are using stats and dumping them into syslog.log, and that's fine. But we see weird "remnants" in user.log. It seems to contain syslog facility messages and is malformed as well. Bug? Or us? 🙂
This is a snip of the expected syslog.log:
2025-11-19T00:00:03.392632-08:00 redacted [syslog.info] syslog-ng[758325]: Log statistics; msg_size_avg='dst.file(d_log#0,/var/log/other/20251110/daemon.log)=111', truncated_bytes='dst.file(d_log#0,/var/log/other/20251006/daemon.log)=0', truncated_bytes='dst.file(d_log_systems#0,/var/log/other/20251002/syste.....
This is a snip of user.log (same event/time looks like):
2025-11-19T00:00:03.392632-08:00 redacted [user.notice] var/log/other/20251022/daemon.log)=111',[]: eps_last_24h='dst.file(d_log#0,/var/log/other/20251022/daemon.log)=0', eps_last_1h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0', eps_last_24h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0',......
Here you can see for user.log that the format is actually messed up. $PROGRAM[$PID]: is missing/truncated (although look at the []: at the end of the first line), and the first part of the $MESSAGE is also missing/truncated.
Some notes:
*
We're running syslog-ng as provided by Red Hat (syslog-ng-3.35.1-7.el9.x86_64)
*
endpoint is logging correctly (nothing in user.log). This is only centralized loghosts that we see this.
*
Stats level 1, freq 21600
Relevant configuration snips:
log { source(s_local); source(s_net_unix_tcp); source(s_net_unix_udp);
filter(f_catchall);
destination(d_arc); };
filter f_catchall { not facility(local0, local1, local2, local3, local4, local5, local6, local7); };
destination d_arc { file("`LPTH`/$HOST_FROM/$YEAR/$MONTH/$DAY/$FACILITY.log" template(t_std) ); };
t_std: template("${ISODATE} $HOST_FROM [$FACILITY.$LEVEL] $PROGRAM[$PID]: $MESSAGE\n");
Thanks for any guidance!
PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.