[syslog-ng]Lost of facility/level

[Balazs Scheidler]

On Tue, Apr 02, 2002 at 11:32:54AM +0100, Jerome Peducasse wrote:
> Hi,
> 
> 	I'm using syslog-ng 1.5.15 and sometimes (probably during message burst), messages lost their facility/level and are logged with user/notice. Message format becomes:
> Mar 29 11:35:50 w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Mar 29 11:35:50 w3search[19816]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 
> 
> instead of: 
> 
> Mar 29 11:32:07 w3search3 w3search[19817]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434
> 
> General log_fifo_size is set to 1000 and is set to 10000 for appropriate filter of this message:
> 
> destination d_applicatif           { file("/ke/logs/ke.log"  owner(test) group(test) log_fifo_size(10000) ); };
> filter f_applicatif     { facility(local0); };
> log { 
>         source(s_sys); 
>         filter(f_applicatif); 
>         destination(d_applicatif); 
>         destination(d_loghost_applicatif); 
>         flags(final);
> };

maybe the end of line is lost somehow. are your logs terminated with a
single '\n' or a '\r\n' pair?

Looking into the code, this might be the cause of the problem, and if it is
the following patch fixes it. Can you please test this?

Index: sources.c
===================================================================
RCS file: /var/cvs/syslog-ng/src/sources.c,v
retrieving revision 1.31
diff -u -r1.31 sources.c
--- sources.c	2002/03/19 09:26:16	1.31
+++ sources.c	2002/04/02 09:59:32
@@ -123,7 +123,7 @@
 		if (length)
 			do_handle_line(closure, length, start, salen ? (abstract_addr *) &sabuf : NULL , salen);
 
-		start = end + 1;
+		start = eol + 1;
 
 		eol = memchr(start, '\0', &closure->buffer[closure->pos] - start);
 		if (eol == NULL)




-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1