On Mon, 2007-01-29 at 20:58 -0500, Fran Loehmann wrote:
On Mon, 29 Jan 2007, Balazs Scheidler wrote:
On Fri, 2007-01-26 at 12:11 -0500, Fran Loehmann wrote:
On Fri, 26 Jan 2007, Balazs Scheidler wrote:
On Thu, 2007-01-25 at 14:18 -0500, Fran Loehmann wrote:
Hi,
I am new to syslog-ng and have set up a system using eventlog-0.2.5 and syslog-ng-2.0.1
Local sendmail messages seem to have 2 entries together. I am not sure if something is awry with the config included below, but it seems to only happen with the sendmail entries from sendmail running on the log host.
I am trying to write messages to both /var/log/maillog and /var/log/archive/2007-01-25. Messages logged from the sending server seem ok but sendmail running on they log server appear to be on the same line seperated by <22>.
Messages in maillog and 2007-01-25 look the same.
can you strace sendmail (or syslog-ng) as it sends/receives a log message?
on unix-stream transport syslog-ng expects messages to be NL or NUL terminated.
In addition to my previous post with the syslog-ng strace output I've attached what seems to be the relevant file from a sendmail strace. (I am uncertain if you need all of the strace)
Seeing the following in the strace... connect(3, {sa_family=AF_FILE, path="/dev/log"}, 16) = -1 EPROTOTYPE (Protocol wrong type for socket)
... I changed unix-stream("/dev/log"); to unix-dgram("/dev/log"); and the message appears as expected in the log.
This is a workaround and not a solution. It just happened that sendmail interops with unix-dgram() better than with unix-stream().
The problem with the strace dump you posted is that it does not contain the complete messages as sent by sendmail. You need to pass the '-s' paramter to strace to include longer strings (for example -s 4096)
Thank you for your guidance and patience. I traced sendmail again and was able to see the messages sent to syslog-ng while using unix-stream. I can send along the whole strace output if helpful. It is ~128k in size.
I looked for the log messages below in the strace output.
Jan 29 19:41:16 secmgmt-cs02 sendmail[15692]: l0U0fGKc015692: from=<loehmanf@secmgmt-cs02.secmgmt.pvt>, size=385, class=0, nrcpts=1, msgid=<200701300041.l0U0fGWk015689@secmgmt-cs02.secmgmt.pvt>, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]<22>Jan 29 19:41:16 sendmail[15693]: l0U0fGKc015692: to=<loehmanf@secmgmt-cs02.secmgmt.pvt>, ctladdr=<loehmanf@secmgmt-cs02.secmgmt.pvt> (1011/999), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30636, dsn=2.0.0, stat=Sent
It seems the first message does not end in \0 as does the second.
This seems to be a sendmail bug then. I don't know why they don't use the syslog() call in libc. -- Bazsi