-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi , On Tuesday 31 December 2002 23:05, you wrote:
I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and I have a log entry like this:
Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't stat file in FlushFile [news/PointCast]: No such file or directory
...but the program name was sent from the app was: "ctlds 6.0[8704]:" and syslog-ng replaced the first part of the messed up program name with the host's name.
In the next version, can syslog-ng "learn" that it don't get a hostname from solaris ever and that the entire text coming in is actually the log
I looked at my logs from Solaris 8 systems using standard solaris syslog and with the exception of some kernel messages the hostname is perfectly ok. Both the 'HOST' and 'FULLHOST' macros in the syslog-ng config file return the proper host name. The only problem are some kernel messages in which the hostname indeed contains the first one or two words of the message as does the 'PROGRAM' field. But even then I found that the 'FULLHOST' macro returns the correct host in its last field (like 'Error/<hostname>'). Possibly this has to do with some awkward way the kernel writes its messages.
message? I'm losing information this way. I wonder how many other apps split up the program name and lose data - most people would never know as end users.
- -- Sander de Boer - -- My public key is available at http://www.sanderscorner.com/file/pgp-pubkey.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+E3DIhNL8OKskREIRAtLrAJ0Wgs8QSXCiuVQjhSp1IMpZc3rapgCg7Amz Qu/Y/0Ult7I5FJLL4uvfUI4= =k6V0 -----END PGP SIGNATURE-----