[syslog-ng] Syslog-ng tcpip & RHEL4, sending only NLs

[simonst at wellsfargo.com]

On RHEL3 servers, 2 of my syslog-ng 2.0rc4 daemons are working fine, sending
logs from one daemon to the other.  The same syslog-ng on 2 RHEL4 servers
connects with a tcpip session, but sends across only newlines, instead of
the actual syslog line data.  Has anyone seen this before?

My syslog-ng was compiled under RHEL3, but it made no difference when I
recompiled both sides under RHEL4.

Here's the sending syslog-ng.conf:
 options { long_hostnames(off); sync(0); };
 source src { unix-stream("/dev/log"); internal(); };
 source kernsrc { file("/proc/kmsg"); };
 destination messages { file("/var/log/messages" owner(root) group(logger)
perm(0640)); };
 destination logger1 { tcp("10.11.12.13" port(5678) template("$UNIXTIME
$HOST $MESSAGE\n") ); };
 log { source(src); source(kernsrc); destination(logger1);
destination(messages); };

And here's the receiving syslog-ng.conf:
 options { long_hostnames(off); sync(0); };
 source src { unix-stream("/dev/log"); internal(); };
 source kernsrc { file("/proc/kmsg"); };
 source PROD_SRVRS { tcp(port(syslog-ng)); } ;
 destination messages { file("/var/log/messages"); };
 destination LOGGER {
    file("/var/log/LOGGER/$YEAR/$MON$DAY"
    owner(root) group(logger) perm(0640) dir_perm(0750) create_dirs(yes)
     template("$MESSAGE\n"));
   };
 log { source(src); source(kernsrc); destination(messages); };
 log { source(PROD_SRVRS); destination(LOGGER); };
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5942 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20070216/8e73ceaf/smime.bin