Sent: Tue Nov 29 2011 18:42:05 GMT-0700 (MST) From: Dave Rawks <dave@pandora.com> To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Bug in rewrite logic, 3.3.3
I've got two different log paths defined that have the same rewrite included in them. The second log path always causes the rewrite to overwrite the incorrect macro value.
If the above configuration is used the events that pass through the second log path have their MESSAGE macro overwritten as "0" instead of their PID macro as is defined in the r_no_pid rewrite rule. The events that pass through the first logpath behave as expected. If I comment out the first logpath then the second behaves as expected.
-Dave
Found this bug the other day as well. Bazsi pointed out that its already been fixed :-) commit 1b52fd8741b33c20e7cdc06b907fb76a981c8874 Author: Balazs Scheidler<bazsi@balabit.hu> Date: Fri Nov 25 12:38:40 2011 +0100 [logrewrite] Repair logrewrite *_clone and *_subst_clone functions (fixes: #7686) Repair rewrite clone functions because we did not clone $MACRO id and conditions. Before this patch if we used rewrite in config file and use example PIPE source we rewrited $MESSAGE macro instead of macro in config file because the $MESSAGE macro was the default macro. Signed-off-by: Fried Zoltan<deirf@balabit.hu> Signed-off-by: Balazs Scheidler<bazsi@balabit.hu>