On Fri, Apr 27, 2001 at 04:39:32PM -0500, Jon Marks wrote:
Earlier I posted a message asking about whether syslog-ng had standard equipment for dealing with a couple of strange message types:
1) Messages forwarded by AIX syslogd which contain the string
"Message forwarded from [hostname]: " ...
and
2) Messages of the form:
"last message repeated _n times"
I haven't received any responses. I've read traffic in the mailing list archives (e.g. December 2000) regarding the topic, but I haven't found any solutions. If I've missed something vital, please help me and let me know about it.. I certainly apologize if I haven't been observant enough to skim the answers from the available resources.
I've taken a stab at solving the problem myself, and I thought I'd share it with all of you. Those of you who are so much more familiar with the source than I, please comment about whether you find I might have broken other functionality or adversely affected performance. I'm glad for you suggestions, or if this can help somebody else. For my installation, being able to handle AIX messages is particularly important.
My solution is just a simple and straightforward refactoring in log.c/parse_log_msg(). A patch against the 1.4.11 source distribution is attached to this message. I've tested it only on AIX, but I think it ought to work elsewhere since it only adds standard library stuff. (Basically, a couple of memcmp's). Some commented-out debugging output (to stderr) is there, too, if you'd want to enable it.
I'll describe the intended effects of this patch:
Are you absolutely sure there's no other way to recognize these messages other than parsing their contents? To be honest I don't like putting too much system dependency into syslog-ng. A compile time/runtime option should be integrated though if there's no other way. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1