https://bugzilla.balabit.com/show_bug.cgi?id=118 Summary: syslog-ng -s errors with catchall flag (1.6 to 3.1) Product: syslog-ng Version: unspecified Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: michael.mishou@csirc.irs.gov Type of the Report: bug Estimated Hours: 0.0 This is a bug report that is pretty much copied from the mailing list, verified by Gergely Nagy. I used this snapshot to find the bug: http://git.balabit.hu/?p=bazsi/syslog-ng-3.1.git;a=snapshot;h=8bf13c304b6ab5... But Gergely reports that the problem exists in multiple 3.x version (and also likely 2.x versions as well). I was getting the error Unknown log statement flag; flag='catchall' when doing a 'syslog-ng -s -f FILE' on a 2.x configuration file using version 3.1.2 of syslog-ng. All the documentation (2.x and 3.x) refers to log path flags: catchall, fallback, final, flow-control. But in center.c the actual strcmp functions are looking for: catch-all, fallback, final, flow_control OR flow-control gint log_connection_lookup_flag(const gchar *flag) { if (strcmp(flag, "catch-all") == 0) return LC_CATCHALL; else if (strcmp(flag, "fallback") == 0) return LC_FALLBACK; else if (strcmp(flag, "final") == 0) return LC_FINAL; else if (strcmp(flag, "flow_control") == 0 || strcmp(flag, "flow-control") == 0) return LC_FLOW_CONTROL; msg_error("Unknown log statement flag", evt_tag_str("flag", flag), NULL); return 0; } I'm guessing it should probably be something like this instead: gint log_connection_lookup_flag(const gchar *flag) { if (strcmp(flag, "catch-all") == 0 || strcmp(flag, "catchall") == 0) return LC_CATCHALL; else if (strcmp(flag, "fallback") == 0) return LC_FALLBACK; else if (strcmp(flag, "final") == 0) return LC_FINAL; else if (strcmp(flag, "flow_control") == 0 || strcmp(flag, "flow-control") == 0) return LC_FLOW_CONTROL; msg_error("Unknown log statement flag", evt_tag_str("flag", flag), NULL); return 0; } Gergely's notes/recommendations for fix: It's the same in 3.2 and 3.3 too - good catch! Whether this is a documentation or code bug, if the docs say it's 'catchall' ever since 2.0, then the code should support that too, along with 'catch-all'. I'd say this is a bug in both: the documentation should be updated to say 'catch-all', which has been working in past versions, and the code should be updated to support what the documentation has been advertising in the past years. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.