On Fri, 2008-03-21 at 15:45 +0100, Jean-Baptiste Quenot wrote:
Dear Balazs,
I incorporated your patch to both 2.1 and 2.2 taken from git, and I could still reproduce the problem. Note that your patch did not apply directly on either of those branches, I had to redo by hand.
These are the versions I have:
libc6 2.6.1-1ubuntu10 perl 5.8.8-7ubuntu3.1 Linux 2.6.22-14-generic
Hmm... I seem to have been wrong. This issue has nothing to do with EOF handling, rather it seems to be related to the fact that syslog-ng accepts both NL and NUL as line terminators, but it prefers NUL over NL. So if the current buffer contains a NUL character, it is used, if it does not NL is used instead. So if the following happens: message1\nmessage2\nmessage3\n\0 ^ | +---- this is the read position In this case message1 is processed normally, NL is taken as its line terminator. Then the remainder is read and the buffer is like: message2\nmessage3\n\0 ^ read position In this case NUL is spotted and the complete line "message2\nmessage3\n" is taken as the log message. This behaviour was changed in syslog-ng PE 2.1 (because of an unrelated change), but not yet in syslog-ng OSE 2.1 & 2.0 (because the same change was not commited to these branches). I'm somewhat reluctant to change the 2.0 branch, as this change is right in the middle of input processing, and I'd like to avoid regressions at all costs. So, I've just pushed a new change in syslog-ng 2.1, it includes the same message parser as the PE version, which drops the NUL preference and accepts either NUL or NL, whichever comes first. I reran your testcase and it fixes the problem for me. You can find the patch here: http://git.balabit.hu/?p=bazsi/syslog-ng-2.1.git;a=commit;h=4de7f364ce8f29eb... -- Bazsi