[syslog-ng]Issue with syslog-ng and process-names with spaces

[Jason Haar]

Hi there

I don't know if this is a bug with syslog-ng-1.6.4 or NTsyslog (which
generated the syslog record), but we have a problem with records generated
by some NT applications showing up "corrupted" within syslog-ng. 

Namely it thinks the hostname is the process name.

However, looking with a sniffer shows what is really going on:

NTSyslog records generally look like:

<(facility tag)>May 17 14:22:22 security[success] blah blah

and syslog-ng records that as

timestamp PTR-record security[success] blah blah


However, what if the process name has spaces in it? It looks like

<(facility tag)>May 17 14:22:22 trend user alert micro scanmail for microsoft \
 exchange[warning]: (msg)

syslog-ng records that as

timestamp trend user alert micro scanmail...


I think syslog-ng is looking at the first word as the process name, and if
it doesn't "look like a process name", then it assumes it must be the
hostname?

Config is:

options { use_dns(yes);
          use_fqdn(yes);
	  dns_cache(no);
	  time_reopen(10);
	  keep_hostname(no);
	  use_time_recvd(yes);
	  log_fifo_size(100);
          mark(0);
          stats(0);
	  sync(5);
	};
		     
Does that sound correct, and is there something I can do to stop it? 

Thanks

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1