[syslog-ng][PATCH] please test: syslog-ng message mangling fix

Stephen Frost sfrost@snowman.net
Tue, 20 Aug 2002 07:38:21 -0400

Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Balazs and everyone,

  The first fix which was posted to the list changing the if to be:

  if (!eol && closure->pos =3D=3D closure->max_log_line)

  appeared to work correctly for me.  The second fix posted which
  changed the if to be:

  if (!eol && (start_pos =3D=3D 0 || closure->pos =3D=3D closure->max_log_l=

  had the same (broken) behaviour as the unmodified if.  This leads me
  to conclude that 'closure->pos =3D=3D closure->max_log_line' is false,
  '!eol' is true and 'start_pos =3D=3D 0' is true.  log_msg_size() does not
  appear to have any effect.  I have increased it to be 2048 and still
  my logs are split amoung lines.  Message length doesn't appear to
  matter either as messages which are longer can end up being intact
  while shorter messages are split.  The one common factor is that all
  of the messages being split are coming from /proc/kmsg.

  Since there was some concern about UDP messages being broken by this
  my first thought is to change the if to be:

  if (!eol && (closure->dgram || closure->pos =3D=3D closure->max_log_line))

  This makes the assumption that messages coming from streams such as a
  TCP connection or /dev/log or a file/pipe will eventually have a
  terminating newline or \0.  Of course, it keeps the sanity check to
  not create messages over max_log_line.  I have this working on my
  setup now but I don't swear that it's perfect, I'd love to hear
  feedback on it, esp. from Balazs.  These messages being split causes
  me a real problem on my firewall.


Content-Type: application/pgp-signature
Content-Disposition: inline

Version: GnuPG v1.0.7 (GNU/Linux)