[syslog-ng] Re: question regarding program name logs

[Justin Randall]

After upgrading and monitoring, the logs which would previously get
logged incorrectly due to the angle bracket prefixing are now not being
logged at all.  These logs don't come in with any peculiarity about
them.  The only thing if interest to note is that it is always the first
log message in a group of log messages (i.e.  host sends 5 Syslog
messages, the first one is missed).

What kind of logs, information would be helpful to diagnose?  I'm
currently running on 2.0rc3.

Regards,

Justin.

-----Original Message-----
From: G.W. Haywood [mailto:ged at jubileegroup.co.uk] 
Sent: Tuesday, September 12, 2006 6:27 AM
To: syslog-ng at lists.balabit.hu
Subject: [syslog-ng] Re: question regarding program name logs

Hi there,

On Tue, 12 Sep 2006 Justin Randall wrote:

> I am currently using Syslog-NG version 2.0rc1.
>
> I've noticed that sometimes when Syslog-NG is logging messages, it
> prefixes something onto the program name which disrupts filters
> while matching against a program name.  For example, in some logs
> for a program named "foo" I'll see logs in the form of "<15>foo"
> which fail to be matched against a filter of 'program("foo") '.
> This seems to only be noticed on logs which originate from remote
> hosts.
>
> Could anyone provide an explanation for what is going on with this?

I reported this problem a couple of weeks ago, and Balazs kindly
provided
a patch which fixed it.  I imagine the patch is in .rc2, try upgrading.

--

73,
Ged.
_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html