[syslog-ng] Losing TAG information

[SOLIS, ALEX]

I have about 20 or so AIX 4.3 servers that are sending syslog messages
to a Linux desktop running syslog-ng 1.6.5.  Every now and then I get a
message that does not contain the TAG information or process ID
information.  When I check the local /var/adm/messages file on the AIX
server, the TAG information is intact.

An example of an intact message on an AIX server is:

Jun 13 09:57:11 myhost dbc4  :     3 TRANSACT          0          0
33686   57:11.60


An example of the same message on my syslog server after syslog-ng gets
a hold of it:

Jun 13 09:57:11 myhost :     3 TRANSACT          0          0      33686
57:11.60


As you can see I am losing the dbc4, why?  Could it be because of the
spaces after the dbc4 string?  According to RFC 3164, a space should
simply terminate the TAG field and begin the content portion of the
message.  Am I misunderstanding how this works?


Thanks


Alex


This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient.  Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance.  If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.