https://bugzilla.balabit.com/show_bug.cgi?id=165 Balazs Scheidler <bazsi@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi@balabit.hu> 2012-03-18 13:21:17 --- that value is only set in the following cases: 1) the incoming message is coming from a remote server and it had this information in the first place (e.g. it was RFC5424 formatted and had this SDATA) 2) the message is received from a local log transport (e.g. /dev/log) However there were two issues with the option 2 above, fixed by these patches: Author: Balazs Scheidler <bazsi@balabit.hu> 2011-09-21 14:11:33 Committer: Balazs Scheidler <bazsi@balabit.hu> 2011-09-23 12:09:22 Parent: 6b62ae6610d659024787339c61335bcbf192120e (dbparser/test_radix: added negative testcases) Child: 6bb06e868d393d17ec0c5682b229b18d660d8553 (LogWriter: initialize the SEQNUM value to 1 in the constructor) Branches: many (39) Follows: v3.3.0beta2 Precedes: v3.3.1 mark locally generated messages as such The LF_LOCAL in LogMessage->flags indicates that the message was generated locally. This flag was not properly set and this patch fixes that issue. Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> Author: Balazs Scheidler <bazsi@balabit.hu> 2011-09-09 15:37:34 Committer: Balazs Scheidler <bazsi@balabit.hu> 2011-09-23 11:44:15 Parent: b835879d1cdab9d06f56d9dfd946198c0308b537 (nvtable: set the minimum size to 128 bytes instead of 256 to avoid breaking the unit tests) Branches: many (40) Follows: v3.3.0beta2 Precedes: v3.3.1 SDATA: include meta.sequenceId value in RFC5424 formatted message The code to include meta.sequenceId was commented out some time ago, since it modified the message right before sending it out on the wire, effectively ruining the message model: this change propagated to parallel branches of the processing pipeline where it shouldn't have. This change fixes that, instead of modifying the message before formatting it with the template, the SDATA payload is automatically extended without having to store sequenceId in the message. Signed-off-by: Viktor Juhasz <jviktor@balabit.hu> Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> This means that this should work if you are using 3.3.1 (but 3.3.4 is the minimum recommended version). You can also set the value for this SDATA through a rewrite rule or a parser. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.