Hello, [if this email is too confusing, I'll split it up into the 3 subjects]
The summary of changes can be found in the file named ChangeLog within the tarball. If no show-stopper bugs are found, I'm going to release syslog-ng 1.6.6 this week.
Ok, the following patch has been applied and works (it's not in the Changelog however), so I can verify this to be fixed: --- macros.gprf 6 May 2004 07:37:10 -0000 1.1.4.1 +++ macros.gprf 13 Dec 2004 18:16:37 -0000 @@ -7,6 +7,7 @@ PRIORITY, M_LEVEL LEVEL, M_LEVEL TAG, M_TAG +PRI, M_PRI DATE, M_DATE FULLDATE, M_FULLDATE ISODATE, M_ISODATE Please have a look at following patch which I'd like to submit: diff -ur syslog-ng-1.6.5+20050202/src/sources.c syslog-ng-1.6.5+20050202-fixed/s rc/sources.c --- syslog-ng-1.6.5+20050202/src/sources.c 2004-08-05 13:35:12.000000000 +0 200 +++ syslog-ng-1.6.5+20050202-fixed/src/sources.c 2005-02-02 11:40:04.0000 00000 +0100 @@ -128,6 +128,9 @@ closure->buffer[closure->pos - 1] == '\0')) closure->pos--; } + if (closure->dgram && !eol && closure->pos == closure->max_log_l ine) { + werror("Message length overflow (ignored the rest)\n"); + } do_handle_line(closure, closure->pos, closure->buffer, salen ? ( abstract_addr *) &sabuf : NULL, salen); closure->pos = 0; return ST_OK | ST_GOON; The issue here is that we would like to get notified somehow that we've exceeded the max_log_line. This is for tuning reasons and also a reason for our support team not to debug log streams for possible corruption. Please consider applying this patch, it adds only minor computing time to the fast path. I see that at about the same line the following code has been added: if (closure->dgram) { /* strip one trailing LF or NUL character */ if (closure->pos > 0 && (closure->buffer[closure->pos - 1] == '\n' || closure->buffer[closure->pos - 1] == '\0')) closure->pos--; } I've dug out a patch in our CVS which somehow tries to achieve roughly the same but using a different manner (more intrusive). Any comment on this: diff -u -r1.37.4.1 sources.c --- sources.c 13 Jan 2004 18:08:02 -0000 1.37.4.1 +++ sources.c 24 Feb 2004 10:37:43 -0000 @@ -115,7 +115,7 @@ closure->pos = 0; return ST_OK | ST_GOON; } - if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) { + if (closure->dgram || (!eol && closure->pos == closure->max_log_line)) { /* we don't have a terminating nl nor \0, and our buffer is full or we are a datagram receiver, when the message is in its own packet. Our bug report regarding this patchlet can be summarised as follows: "syslog-ng assumes that NL or NUL terminates messages regardless of the transport medium used." Please verify and report back if you have time. It helps us cleaning up our local patch repository :). Best regards, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------