[syslog-ng] No line break every so often

[Mike Tremaine]

On Thu, 2005-05-19 at 08:12, Mike Tremaine wrote:
> On Wed, 2005-05-18 at 23:51, Balazs Scheidler wrote:
> > On Wed, 2005-05-18 at 17:53 -0700, Mike Tremaine wrote:
> > > I just converted a Redhat 9 machine to syslog-ng yesterday and I'm
> > > having a littel problem with 2 lines running together. Here are the
> > > specs in question.
> > > 
> > > mgt at quasar ~ [1] rpm -q syslog-ng
> > > syslog-ng-1.6.7-2
> > > mgt at quasar ~ [2] rpm -q sendmail
> > > sendmail-8.13.3-2.rhl9
> > > mgt at quasar ~ [3] rpm -q libol
> > > libol-0.3.16-1
> > > mgt at quasar ~ [4] uname -a
> > > Linux quasar 2.4.20-37.9.legacy #1 Mon Sep 27 19:40:23 EDT 2004 i686
> > > i686 i386 GNU/Linux
> > > 
> > > The problem I'm seeing is every so often sendmail will log like so...
> > > 
> > > May 18 17:45:46 quasar sendmail[30415]: j4J0jdNg030415: from=<millie.zuniga_om at southtrust.com>, size=2520, class=0, nrcpts=1, msgid=<2.2.32.2004051809282400312642 at southtrust.com>, proto=ESMTP, daemon=MTA, relay=[220.80.216.171]<22>May 18 17:45:46 sendmail[30415]: j4J0jdNg030415: Milter add: header: Received-SPF: none (quasar.stellarcore.net: 220.80.216.171 is neither permitted nor denied by domain of southtrust.com) receiver=quasar.stellarcore.net; client-ip=220.80.216.171; helo=localhost; envelope-from=millie.zuniga_om at southtrust.com; x-software=spfmilter 0.93 http://www.acme.com/software/spfmilter/;
> > > 
> > > Notice the 22 that should be a line break between the 2 log lines. Has
> > > anyone noticed something like this?
> > 
> > There used to be problems like this, but I haven't encountered this for
> > a time now.
> > 
> > What is your configuration, are you using unix-dgram or unix-stream to
> > get local messages?
> 
> unix-stream ("/dev/log");
> 
> I kept the standard syslog-ng.conf file that was packaged in the rpm
> with very few changes. [ log_fifo_size (64000); and 1 extra destination
> ]
> 
> In looking through yesterdays logs I can confirm that this is only
> happening to sendmail logs. But like I said I just installed syslog-ng 2
> days ago and was not having this issue with the standard syslog.

Just to follow up a little. I tried tweaking a few configuration options
[sync, fifo, max connections] but with out success. I also tried two
older version syslog-ng-1.6.5-4 and syslog-1.6.5-2. The problem [for me
atleast] exists under these version also.

Very odd, almost like sendmail is not giving a proper EOL. I looked in
sources.c [do_read_line] but my c is weak and nothing jumped out at me.

I'm open to suggestions, I'm also willing to move up to 1.9 if this is
not worth debugging.

Thanks for listening to me,


-- 
Mike Tremaine
mgt at stellarcore.net
http://www.stellarcore.net