On Tue, Apr 02, 2002 at 11:32:54AM +0100, Jerome Peducasse wrote:
Hi,
I'm using syslog-ng 1.5.15 and sometimes (probably during message burst), messages lost their facility/level and are logged with user/notice. Message format becomes: Mar 29 11:35:50 w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Mar 29 11:35:50 w3search[19816]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434
instead of:
Mar 29 11:32:07 w3search3 w3search[19817]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434
General log_fifo_size is set to 1000 and is set to 10000 for appropriate filter of this message:
destination d_applicatif { file("/ke/logs/ke.log" owner(test) group(test) log_fifo_size(10000) ); }; filter f_applicatif { facility(local0); }; log { source(s_sys); filter(f_applicatif); destination(d_applicatif); destination(d_loghost_applicatif); flags(final); };
maybe the end of line is lost somehow. are your logs terminated with a single '\n' or a '\r\n' pair? Looking into the code, this might be the cause of the problem, and if it is the following patch fixes it. Can you please test this? Index: sources.c =================================================================== RCS file: /var/cvs/syslog-ng/src/sources.c,v retrieving revision 1.31 diff -u -r1.31 sources.c --- sources.c 2002/03/19 09:26:16 1.31 +++ sources.c 2002/04/02 09:59:32 @@ -123,7 +123,7 @@ if (length) do_handle_line(closure, length, start, salen ? (abstract_addr *) &sabuf : NULL , salen); - start = end + 1; + start = eol + 1; eol = memchr(start, '\0', &closure->buffer[closure->pos] - start); if (eol == NULL) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1