It seems, it occurs errors with long messages. With this code: KELOG_RELEASE(( LOG_ERR, \ "not enougth space to make result ouput! \n varlen=%d len=%d max_len=%d \n result is '%s'\n" WHERE, \ varlen, len, max_len, result, \ HERE )); messages come in user.notice instead of local0.err: Apr 16 11:18:43 w3search1.search.fr.ke.echo [user.notice] varlen=19 varlen=19 len=2048 max_len=2048 Apr 16 11:18:43 w3search1.search.fr.ke.echo [user.notice] result result is \'<SP TYPE=\'L\'> / 406 / Safrane / BMW série 5 145 </SP><SP TYPE=\'W\'>x</SP><SP TYPE=\'L\'> 80 </SP><SP TYPE=\'W\'>x</SP><SP TYPE=\'L\'> 13 145 </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> 13 155 </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>70</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> 13 </SP><SP TYPE=\'W\'>165</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>70</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> 13 175 </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>70</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> 13 185 </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>70</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> 13 </SP><SP TYPE=\'W\'>165</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>70</SP><SP TYPE=\'L\'> ! </SP><SP TYPE=\'W\'>X</SP><SP TYPE=\'L\'> </SP><SP TYPE=\'W\'>14<131>Apr 16 11:18:43 w3search[2495]: not enougth space to make result ouput! Apr 16 11:18:43 w3search1.search.fr.ke.echo [user.notice] varlen=6 varlen=6 len=2048 max_len=2048 Apr 16 11:18:43 w3search1.search.fr.ke.echo [user.notice] <131>Apr 16 11:18:43 w3search[2495]: SmartPreview failed for ip=159884415 in enum echo::keret echo::ThalieClient::getDoc(uint32 &, echo::ThalieDocument *, const echo::Query &, const echo::Answer *, const char (*)[255]):ThalieClient.cc:642 Attached file contains result output of strace. Thanks On Thu, Apr 11, 2002 at 05:56:57PM +0100, Jerome Peducasse wrote:
On Thu, Apr 11, 2002 at 04:39:44PM +0200, Balazs Scheidler wrote:
On Thu, Apr 11, 2002 at 04:31:03PM +0100, Jerome Peducasse wrote:
Hi,
I have applied your patch since one week and I already report some errors such as: Apr 11 14:49:32 w3search3/w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Apr 11 14:49:32 frontatlas[9192]: read Context failed on socket=6 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434
Both embedded messages come with facility user instead of local0 (on localhost and on loghost).
can you strace syslog-ng (with -s <high number> specified) or tcpdump the syslog traffic to see whether syslog-ng or your device is at fault? I don't think it's a device fault because I have 2 destinations (local and loghost) and error appears on both. I launch strace on some computer and I wait ...
Thanks.
-- Jerome Peducasse
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
-- Jerome Peducasse Wanadoo Portails - Sophia Antipolis