[syslog-ng][PATCH] please test: syslog-ng message mangling fix
Stephen Frost
sfrost@snowman.net
Tue, 20 Aug 2002 07:38:21 -0400
--mhOzvPhkurUs4vA9
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Balazs and everyone,
The first fix which was posted to the list changing the if to be:
if (!eol && closure->pos =3D=3D closure->max_log_line)
appeared to work correctly for me. The second fix posted which
changed the if to be:
if (!eol && (start_pos =3D=3D 0 || closure->pos =3D=3D closure->max_log_l=
ine))
had the same (broken) behaviour as the unmodified if. This leads me
to conclude that 'closure->pos =3D=3D closure->max_log_line' is false,
'!eol' is true and 'start_pos =3D=3D 0' is true. log_msg_size() does not
appear to have any effect. I have increased it to be 2048 and still
my logs are split amoung lines. Message length doesn't appear to
matter either as messages which are longer can end up being intact
while shorter messages are split. The one common factor is that all
of the messages being split are coming from /proc/kmsg.
Since there was some concern about UDP messages being broken by this
my first thought is to change the if to be:
if (!eol && (closure->dgram || closure->pos =3D=3D closure->max_log_line))
This makes the assumption that messages coming from streams such as a
TCP connection or /dev/log or a file/pipe will eventually have a
terminating newline or \0. Of course, it keeps the sanity check to
not create messages over max_log_line. I have this working on my
setup now but I don't swear that it's perfect, I'd love to hear
feedback on it, esp. from Balazs. These messages being split causes
me a real problem on my firewall.
Thanks,
=09
Stephen
--mhOzvPhkurUs4vA9
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE9YiotrzgMPqB3kigRAsOuAJ44YrouWW6U0Dn7BNr2DZBaQPqNtACfSh7i
BwHkZoWuZrXq2QtqOWMUhRA=
=KHC5
-----END PGP SIGNATURE-----
--mhOzvPhkurUs4vA9--