[syslog-ng] syslog-ng incorrectly parsing some messages

Crayola crayola at optonline.net
Tue Nov 8 03:45:15 CET 2005


I am running syslog-ng 1.8.6 on my central syslog server. 
The syslog clients run standard syslog daemons that come 
with the operating systems. Solaris, Cisco, etc. 

I have noticed in my syslog-ng database (mysql) that there are 
many entries like these.  (two separate rows)

| 192.168.11.27  | kern     | info     | info    | 06   | 2005-11-05 | 
 22:37:20 | scsi | scsi: [ID 365881 kern.info] /sbus at 2,0/QLGC,isp at 1,10000 
(isp0): | 512925 |

-------------------------------------------------------------------------

|       Firmware      | kern     | info     | info    | 06   | 2005-11-05 
| 22:37:20 | Version         | Version: v1.37.5, Customer: 15, Product: 0
| 512926 |

These seem to be the result of syslog-ng incorrectly (or the remote client)
parsing the syslog message. 

This is the original syslog messages that the Solaris 9 client 
logs to its logs. 

Nov  5 22:37:20 lefou scsi: [ID 365881 kern.info] /sbus at a,0/QLGC,isp at 1,10000
(isp1):
Nov  5 22:37:20 lefou   Firmware Version: v1.37.5, Customer: 15, Product: 0

As you can see the original is two separate messages as well but what gets 
logged to syslog-ng's database doesn't contain the hostname for the second
message. 
In the second entry.. the hostname is listed as "Firmware" 

I have found many examples of these multiline messages being parsed
incorrectly 
if you need more. 

Any ideas? 

Thanks, 
Mike

Another example...

Nov  5 22:37:20 lefou scsi: [ID 365881 kern.info]
/sbus at 3,0/SUNW,fas at 3,8800000 (fas0):
Nov  5 22:37:20 lefou   rev 2.2 FEPS chip

| 192.168.11.27  | kern     | info     | info    | 06   | 2005-11-05 |
22:37:20
| scsi | scsi: [ID 365881 kern.info] /sbus at 3,0/SUNW,fas at 3,8800000 (fas0): |
512932 |

| rev | kern | info     | info    | 06   | 2005-11-05 | 22:37:20 | | 2.2
FEPS chip
| 512933 |




More information about the syslog-ng mailing list