[syslog-ng] trailing spaces on udp messages (now with NULLs!)

[Johan Fischer]

Balazs Scheidler wrote:
> On Tue, 2007-01-23 at 11:58 +1100, Johan Fischer wrote:
>> Works for me too, Thanks :)
>>
>> Some programs still have trailing spaces in their logs like openldap and the 
>> kernel iptables message, but I guess we can't do much about it ... ( an option 
>> in the source / dest to trim spaces maybe ? ).
> 
> In these cases the sender application adds the space, and it is a
> legitimate part of the message. syslog-ng could trim this off, but only
> with an explicit option, I would not want to do this by default.
> 
Thanks, I guessed that much about the remaining ones, which is why I proposed an
configuration option in either the input/ouptut and a filter to specifically
remove it on a case by case basis, and the same as you, I don't want this as a
default ....

>> There is also one last part in the syslog-ng internal messages which has a 
>> trailing space:
>>
>> Jan 23 11:45:04 s_internal at mira syslog-ng[6559]: SIGTERM received, terminating;
> 
> this is the same thing above, eventlog always puts a ' ' to the end of
> the message. I'd call this a bug...

Thanks :) will test it.


> 
> ...and this patch should fix it:
> 
> --- orig/src/evtfmt.c
> +++ mod/src/evtfmt.c
> @@ -57,7 +57,9 @@ evtrec_format_plain(EVTREC *e)
>      return NULL;
>    
>    evt_str_append_escape_bs(es, e->ev_desc, strlen(e->ev_desc), ';');
> -  evt_str_append(es, "; ");
> +  evt_str_append(es, ";");
> +  if (e->ev_pairs)
> +    evt_str_append(es, " ");
>    for (et = e->ev_pairs; et; et = et->et_next)
>      {
>        evt_str_append(es, et->et_tag);
> 
> 
> 
> 
> 

-- 
Johan Fischer
Capital Markets Surveillance Services Pty Limited
Level 2, 9 Castlereagh Street, Sydney NSW 2000
Tel: +61 2 9233 7999   Direct: +61 2 9236 9150
Fax: +61 2 9236 9177   http://www.cmss-systems.com

Capital Markets Surveillance Services Pty Ltd (CMSS) - Confidential
Communication
The information contained in this e-mail is confidential. It is intended
solely for the addressee. If you receive this e-mail by mistake please
promptly inform us by reply e-mail and then delete the e-mail and
destroy any printed copy. You must not disclose or use in any way the
information in the e-mail. There is no warranty that this e-mail is
error or virus free. It may be a private communication, and if so, does
not represent the views of the CMCRC and its associates. If it is a
private communication, care should be taken in opening it to ensure that
undue offence is not given.