Null characters with PIX and Syslog-ng-1.6.Orc4
Hi, More of an observation than a cry for help... I had a problem grepping for information in my syslog-ng logs from PIX's. After alot of investigation I found a null character sitting (invisibly) at the end of the time field - /usr/bin/grep will not look past the null character. The PIXs timestamp the syslog message (in this case - not by default) and I could not see a syslog-ng configurable cause of this. So like the coward I am ;) I uninstalled 1.6 and went back to 1.4.17 - which did not have the problem. So really this is just a heads up for anyone seeing the same issue and maybe if anyone knows the cause and/or knows the fix. As long as you don't have to spend all morning trying to fix grep...If you think you might have this the command to check for null characters is cat <file> | perl -nge 's/\000/XXX/g' - XXX marks the spot. Probably can do it in sed or tr as well. Best Regards Bill Miller Internet Security Architect Energis ******************************************************** This e-mail is sent by Energis Communications Limited and its contents are confidential and may be legally privileged. ********************************************************
On Mon, Dec 01, 2003 at 03:53:24PM -0000, Bill Miller wrote:
Hi,
More of an observation than a cry for help...
I had a problem grepping for information in my syslog-ng logs from PIX's. After alot of investigation I found a null character sitting (invisibly) at the end of the time field - /usr/bin/grep will not look past the null character. The PIXs timestamp the syslog message (in this case - not by default) and I could not see a syslog-ng configurable cause of this. So like the coward I am ;) I uninstalled 1.6 and went back to 1.4.17 - which did not have the problem.
So really this is just a heads up for anyone seeing the same issue and maybe if anyone knows the cause and/or knows the fix. As long as you don't have to spend all morning trying to fix grep...If you think you might have this the command to check for null characters is cat <file> | perl -nge 's/\000/XXX/g' - XXX marks the spot. Probably can do it in sed or tr as well.
Hi, I've already fixed this and posted a patch on this list, though I have not released a new version. The next revision (which will be called 1.6.1 will be released RSN) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
participants (2)
-
Balazs Scheidler
-
Bill Miller