On Mon, 2004-12-13 at 14:51, Roberto Nibali wrote:
When I start syslog-ng like follows:
# /sbin/syslog-ng -F -f /etc/syslog-ng.conf
I get the output (regarding the line: tcp("X.Y.W.Z" port(1514) template("<$PRI>$DATE $HOST $TAG $MSG\n"));
DEBUG: this is the id '30' DEBUG: this is the id '20' DEBUG: I'm in M_TAG in macros.c DEBUG: this is the id '440' DEBUG: this is the id '480'
The real syslog-ng.conf is huge but the line above is the only part where I have macro expansion, so I know that I fall through that destination. As you can see I do not get the id '21' which would be M_PRI. It seems to be lost. If I check with
tcpdump -X -s 1500 -n -i eth0 tcp and port 1514
I get something like following line:
<>Dec 13 12:57:01 hostname app[1213]:
Look, to me it looks like maybe msg-pri is not available at the expansion time. Maybe I also did something extremely stupid but I honestly have no time to debug it any further right now and the patch I've sent earlier solves my problem.
I'll check once again though to see if I really missed something obvious :).
Sorry. You are right, PRI was not added to the gperf lookup table, thus it was never resolved. Index: macros.gprf =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/macros.gprf,v retrieving revision 1.1.4.1 diff -u -r1.1.4.1 macros.gprf --- macros.gprf 6 May 2004 07:37:10 -0000 1.1.4.1 +++ macros.gprf 13 Dec 2004 18:16:37 -0000 @@ -7,6 +7,7 @@ PRIORITY, M_LEVEL LEVEL, M_LEVEL TAG, M_TAG +PRI, M_PRI DATE, M_DATE FULLDATE, M_FULLDATE ISODATE, M_ISODATE -- Bazsi