Keep fighting the good fight, hopefully you'll get some hints soon. You're well outside the range of my debugging-fu at this point. On Thu, Dec 16, 2010 at 3:34 PM, Matthew Hall <mhall@mhcomputing.net> wrote:
Getting closer.
The problem goes away when the XML pattern DB is disabled. The problem does not appear if the XML pattern db is used in one log {} per below. Once it is used in two log {} blocks, KABOOM! I'm going to try debugging the other half of this which writes to the persistent store to see if I can sort out what's breaking the write. For what it's worth, the problem shows up in both 32 and 64 bit.
Matthew.
parser p_mon { db-parser(file("/home/y/conf/syslog-ng/xml/mon-db.xml")); };
# parsed log { source(s_udp); source(s_tcp); filter(f_mon_useless); parser(p_mon); filter(f_class_security); rewrite(r_set_format_parsed); rewrite(r_set_type); destination(d_normal);
rewrite(r_set_format_welf); rewrite(r_add_welf_raw); destination(d_welf_loghive_sp2); destination(d_welf); };
# unparsed log { source(s_udp); source(s_tcp); filter(f_mon_useless); # XXX: problem disappears when this one is commented out # parser(p_mon); filter(f_class_unknown); rewrite(r_set_format_unparsed); rewrite(r_set_type); destination(d_normal); };
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html