On Wed, 2005-05-18 at 23:51, Balazs Scheidler wrote:
On Wed, 2005-05-18 at 17:53 -0700, Mike Tremaine wrote:
I just converted a Redhat 9 machine to syslog-ng yesterday and I'm having a littel problem with 2 lines running together. Here are the specs in question.
mgt@quasar ~ [1] rpm -q syslog-ng syslog-ng-1.6.7-2 mgt@quasar ~ [2] rpm -q sendmail sendmail-8.13.3-2.rhl9 mgt@quasar ~ [3] rpm -q libol libol-0.3.16-1 mgt@quasar ~ [4] uname -a Linux quasar 2.4.20-37.9.legacy #1 Mon Sep 27 19:40:23 EDT 2004 i686 i686 i386 GNU/Linux
The problem I'm seeing is every so often sendmail will log like so...
May 18 17:45:46 quasar sendmail[30415]: j4J0jdNg030415: from=<millie.zuniga_om@southtrust.com>, size=2520, class=0, nrcpts=1, msgid=<2.2.32.2004051809282400312642@southtrust.com>, proto=ESMTP, daemon=MTA, relay=[220.80.216.171]<22>May 18 17:45:46 sendmail[30415]: j4J0jdNg030415: Milter add: header: Received-SPF: none (quasar.stellarcore.net: 220.80.216.171 is neither permitted nor denied by domain of southtrust.com) receiver=quasar.stellarcore.net; client-ip=220.80.216.171; helo=localhost; envelope-from=millie.zuniga_om@southtrust.com; x-software=spfmilter 0.93 http://www.acme.com/software/spfmilter/;
Notice the 22 that should be a line break between the 2 log lines. Has anyone noticed something like this?
There used to be problems like this, but I haven't encountered this for a time now.
What is your configuration, are you using unix-dgram or unix-stream to get local messages?
unix-stream ("/dev/log"); I kept the standard syslog-ng.conf file that was packaged in the rpm with very few changes. [ log_fifo_size (64000); and 1 extra destination ] In looking through yesterdays logs I can confirm that this is only happening to sendmail logs. But like I said I just installed syslog-ng 2 days ago and was not having this issue with the standard syslog. -- Mike Tremaine mgt@stellarcore.net http://www.stellarcore.net