On Wed, 2011-03-02 at 09:10 -0800, Matthew Hall wrote:
On Wed, Mar 02, 2011 at 05:55:54PM +0100, Balazs Scheidler wrote:
On Wed, 2011-03-02 at 12:28 +0100, Valentijn Sessink wrote:
Hi Balázs,
LogWriter: added support for a new flag 'ignore-errors'
Unfortunately, I can't get syslog-ng to re-write a broken message, even with fsync(yes). However, with your patch, it feels safer, because *if* a blocking message would be there, it would be ignored from now on.
did you check that with strace?
I now checked the kernel source, and the recent match really seems to error out on invalid formats with EINVAL.
I'd really like to know what is going on, syslog-ng should try that operation again, and it feels like a bug.
Could the problems be prevented by using a PCRE rule to verify the message passes a regex format validity filter before kicking it into the file?
yes, sure that could be possible. -- Bazsi