Through further experimentation, I have found out more information on my UDP problem. In short: syslog-ng, or more accurately, libol (do_read_line() in read_line.c) requires all messages to end in '\n'. This is fine for messages sent from a Linux box, but not for messages sent from some other systems (HP-UX, and probably others). If I remember correctly, the standard BSD implementation doesn't require a linefeed character, so it's not a good idea to depend on it, and the standard Linux sysklogd not only doesn't require a LF, but actually goes and converts them to spaces. Given the current implementation, the easiest thing to do might be to ensure that messages received via UDP end in a linefeed, appending one if necessary. While not technically the "best" way to fix this, it's certainly the easiest.
read_line looks for both \n and \0 to end a line. Maybe HP-UX doesn't add \0 either? I've run into some design problems regarding UDP packets, so I am redesigning some internal parts of syslog-ng. (internally there's currently no way passing a source address along with a log message => I can't find out the source hostname with udp packets) As soon as this is resolved, I'll release a new version. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi@balabit.hu