[syslog-ng]Lost of facility/level

[Jerome Peducasse]

Hi,
	
	I have applied your patch since one week and I already report some errors such as:
Apr 11 14:49:32 w3search3/w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Apr 11 14:49:32 frontatlas[9192]: read Context failed on socket=6 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 

Both embedded messages come with facility user instead of local0 (on localhost and on loghost).

 
Any idea?



On Tue, Apr 02, 2002 at 12:06:48PM +0200, Balazs Scheidler wrote:
> On Tue, Apr 02, 2002 at 11:32:54AM +0100, Jerome Peducasse wrote:
> > Hi,
> > 
> > 	I'm using syslog-ng 1.5.15 and sometimes (probably during message burst), messages lost their facility/level and are logged with user/notice. Message format becomes:
> > Mar 29 11:35:50 w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Mar 29 11:35:50 w3search[19816]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 
> > 
> > instead of: 
> > 
> > Mar 29 11:32:07 w3search3 w3search[19817]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434
> > 
> > General log_fifo_size is set to 1000 and is set to 10000 for appropriate filter of this message:
> > 
> > destination d_applicatif           { file("/ke/logs/ke.log"  owner(test) group(test) log_fifo_size(10000) ); };
> > filter f_applicatif     { facility(local0); };
> > log { 
> >         source(s_sys); 
> >         filter(f_applicatif); 
> >         destination(d_applicatif); 
> >         destination(d_loghost_applicatif); 
> >         flags(final);
> > };
> 
> maybe the end of line is lost somehow. are your logs terminated with a
> single '\n' or a '\r\n' pair?
> 
> Looking into the code, this might be the cause of the problem, and if it is
> the following patch fixes it. Can you please test this?
> 
> Index: sources.c
> ===================================================================
> RCS file: /var/cvs/syslog-ng/src/sources.c,v
> retrieving revision 1.31
> diff -u -r1.31 sources.c
> --- sources.c	2002/03/19 09:26:16	1.31
> +++ sources.c	2002/04/02 09:59:32
> @@ -123,7 +123,7 @@
>  		if (length)
>  			do_handle_line(closure, length, start, salen ? (abstract_addr *) &sabuf : NULL , salen);
>  
> -		start = end + 1;
> +		start = eol + 1;
>  
>  		eol = memchr(start, '\0', &closure->buffer[closure->pos] - start);
>  		if (eol == NULL)
> 
> 
> 
> 
> -- 
> Bazsi
> PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng

-- 
Jerome Peducasse