The mail below was originally sent to one of our internal addresses, but since it's a bug report against 3.2 and 3.3, it is better to have it posted here too (with original files attached): Da Mota Sam <da.mota.sam@gmail.com> wrote:
Hi,
I think I found a bug in syslog-ng starting from version 3.2.
You will find in attachment the smallest configuration files for which the bug appears. These files must be placed in /etc/syslog-ng "to work".
The problem seems to be in a bad handling of characters with accents.
With the attached configuration files, when syslog-ng receives a message containing just "1 é" (for exemple by calling "logger '1 é') one should expect the creation of a file /var/log/message_with_id_matched This file isn't actually created.
The given file pattern_rules.xml contains two patterns. If I remove one of them, then I get the creation of the file /var/log/message_with_id_matched, which makes me think that one of the pattern shadows the other one.
About: I got this erroneous behaviour with: - syslog-ng 3.2.4 on debian wheezy (from debian packages) - syslog-ng 3.2.4 on debian lenny (from syslog-ng source code) - syslog-ng 3.2.4 on debian squeeze (from syslog-ng source code) - syslog-ng 3.2.5 on debian squeeze (from syslog-ng source code) - syslog-ng 3.3.1 on debian wheezy (using the packages of debian sid)
the bug was not present on syslog-ng 3.1 on debian squeeze (from debian packages)
Could you please check that you get the same errors, and let me know about it? (so I could bug report this to the debian team if it is not a syslog-ng bug).
Best regards, -- Samuel Da Mota
-- |8]