I think I found it -- in the resolve_sockaddr function, the resolved hostname is being returned without being NULL-terminated. This patch fixes it: diff -Naur syslog-ng-3.1.2/src/misc.c syslog-ng-3.1.2-patch/src/misc.c --- syslog-ng-3.1.2/src/misc.c Wed May 5 05:03:33 2010 +++ syslog-ng-3.1.2-patch/src/misc.c Mon Nov 22 13:55:01 2010 @@ -254,6 +254,9 @@ if (len <= *result_len) *result_len = len; } + + /* Ensure that result is null-terminated */ + result[*result_len] = '\0'; } However, I'm by no means a developer so I don't know if this is safe or even if it's the right fix. Paul Krizak 7171 Southwest Pkwy MS B200.3A MTS Systems Engineer Austin, TX 78735 Advanced Micro Devices Desk: (512) 602-8775 Linux/Unix Systems Engineering Cell: (512) 791-0686 Global IT Infrastructure Fax: (512) 602-0468 On 11/22/10 11:45, Paul Krizak wrote:
Hi, all. Hopefully this is a quick and easy one --
I am working on upgrading our grid from syslog-ng 2.1.4 to 3.1.2. But it looks like chained hostnames are broken now.
Here's what a typical message looked like in 2.1.4:
Nov 19 12:24:58 s_internal@svvspd02 syslog-ng[4083]: syslog-ng starting up; version='2.1.4'
And in v3, it now looks like this:
Nov 22 09:17:39 s_self@svvspd02@F<D5> ^G syslog-ng[2527]: syslog-ng starting up; version='3.1.2'
Notice the stray characters after the hostname (this is pasted from 'less' so the nonprintable chars have been expanded).
This looks suspiciously like a strcpy() gone awry -- like a NULL didn't get tacked onto the end of the hostname when the chained hostname string was built up.
Is this a known bug? If so, is there a patch posted in git that I can pull down and rebuild?
Thanks!