[Bug 179] New: SDATA from Loggen Not Recorded
https://bugzilla.balabit.com/show_bug.cgi?id=179 Summary: SDATA from Loggen Not Recorded Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: bmehne@gmail.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=60) --> (https://bugzilla.balabit.com/attachment.cgi?id=60) Syslog-ng conf I have been trying to find some API to write SDATA to mongodb, but it seems that syslog-ng is not parsing the sdata correctly or loggen is not being called correctly. I am calling loggen with: loggen -r 5 -P -p "[syslog@0 uid=\"system\" id=\"4937903063198901248\" sid=\"-\" svchome=\"/run/cronsvc/01/1\" svcid=\"dummy\" name=\"JobExecutionStateManagementJob\" tid=\"__system__\" type=\"SYSTEM\" cid=\"-\" eid=\"-\"]" -S -s 1024 -i -I 2000 localhost 1000 My syslog-ng.conf is attached. I have compiled and run with syslog-ng 3.3.1 (from tar), 3.3.4 (as in debian repos), and 3.4 (from github). I have also tried with the mongodb driver patched to insert rather than upsert (from algernon github repo, flat-insert branch). My testing is taken from http://www.syslog.org/forum/index.php?topic=1233.0 My /var/log/messages.json spits out empty braces (e.g. { } ) for each message, and mongodb does record "SDATA" : "[meta sequenceId=\"70\"]",but that is not the intended sdata. Any help would be appreciated. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=179 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu --- Comment #1 from Gergely Nagy <algernon@balabit.hu> 2012-05-09 11:36:42 --- (In reply to comment #0)
Created an attachment (id=60) --> (https://bugzilla.balabit.com/attachment.cgi?id=60) [details] Syslog-ng conf
I have been trying to find some API to write SDATA to mongodb, but it seems that syslog-ng is not parsing the sdata correctly or loggen is not being called correctly.
SDATA is only parsed when using the new syslog protocol, as opposed to the legacy protocol. The tcp() source parses messages according to the legacy format by default, syslog() source parses according to the new protocol. You should either change tcp() to syslog(), or add flags(syslog-protocol) to the tcp() source you expect SDATA on. The two protocols should not be mixed, however, so make sure that only the proper format is sent. Hope this helps! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=179 Ben Mehne <bmehne@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |WORKSFORME Status|NEW |RESOLVED --- Comment #2 from Ben Mehne <bmehne@gmail.com> 2012-05-10 00:25:25 --- Yes, that did it (though I could not get the flags to work with tcp, syslog() worked well). It might be worth while to link the SDATA macros to the need for the flags. Thanks for the help -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com