[syslog-ng] No line break every so often

[Balazs Scheidler]

On Thu, 2005-05-19 at 11:01 -0700, Mike Tremaine wrote:
> On Thu, 2005-05-19 at 08:12, Mike Tremaine wrote:
> > On Wed, 2005-05-18 at 23:51, Balazs Scheidler wrote:
> > > On Wed, 2005-05-18 at 17:53 -0700, Mike Tremaine wrote:
> > 
> > In looking through yesterdays logs I can confirm that this is only
> > happening to sendmail logs. But like I said I just installed syslog-ng 2
> > days ago and was not having this issue with the standard syslog.
> 
> Just to follow up a little. I tried tweaking a few configuration options
> [sync, fifo, max connections] but with out success. I also tried two
> older version syslog-ng-1.6.5-4 and syslog-1.6.5-2. The problem [for me
> atleast] exists under these version also.
> 
> Very odd, almost like sendmail is not giving a proper EOL. I looked in
> sources.c [do_read_line] but my c is weak and nothing jumped out at me.
> 
> I'm open to suggestions, I'm also willing to move up to 1.9 if this is
> not worth debugging.
> 

If your log volume is bearable, it would help if you could attach strace
to the syslog-ng process with a large -s parameter while a broken
message is received. e.g. something like:

strace -s 4096 -o syslog-ng.trace -p <syslog-ngpid> 

That would help to identify whether syslog-ng or sendmail is at fault.

Standard syslogd uses unix-dgram sockets, but if sendmail uses the
standard syslog() routines from libc it should simply work with
unix-stream() as well.

-- 
Bazsi