[syslog-ng]pipe() under hpux-11 and timestamp

[Balazs Scheidler]

On Thu, Jul 04, 2002 at 01:28:18PM +0200, Trapp, Michael wrote:
> hi,
> 
> i am running syslog-ng 1.5.18 on hpux 11.00
> with the following options:
>                 use_time_recvd(yes);
>                 use_fqdn(yes);
>                 sync(0);
>                 use_dns(yes);
>                 dns_cache(yes);
>                 dns_cache_size(10000);
>                 dns_cache_expire(3600);
>                 dns_cache_expire_failed(300);
>                 keep_hostname(no);
>                 chain_hostnames(no);
>                 gc_idle_threshold(50);
>                 gc_busy_threshold(5000);
>                 log_fifo_size(2000);
> 
> reading from udp() and pipe()
> 
> 
> as far as i can see the pipe("/dev/log") isn't working correct.
> with a simple fgets() i can see that the messages are
> '0' terminated strings, but syslog-ng reads the whole message
> obviously each message has 4096 bytes and print out several
> lines filled up with characters from the buffer behind the string
> termination.
> 
> i have also configured use_time_recvd(yes) but there are a few messages
> which don't have the right timestamp or are not in the right order (just a
> few seconds).
> in adition the day field of this lines has a leading '0'.
> 
> has anybody experienced these problems?
> are there further options to improve the performance,
> as i can see syslog-ng still miss some packets.

syslog-ng has known problems wrt local log messages on hp-ux. the problem is
that hp-ux differs in how messages are sent to the pipe() source.

The pipe() source expects either NUL or NL terminated strings, but HP-UX
- in addition to terminating the string correctly - pads the whole message
to IIRC 2048 bytes. This remainder is not handled by syslog-ng currently.

It is handled by my private 2.x branch, but it hass not been released yet.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1