[syslog-ng] syslog-ng under HP-UX processing unwanted "padded" data

[Scott Rochford]

Hi,

I'm trying to test syslog-ng under HP-UX 11iv2 (both PA-RISC and IA64) to 
use as an alternative to the supplied syslogd.

I have tried using the precompiled 3.0.5 binaries supplied with HP's DSAU 
(Distributed Systems Administration Utilities) pack, as well as compiling 
3.0.5 and also version 3.1.2 from source.  In all 3 cases I have the same 
problem; it seems to be attempting to process the padded data remaining in 
the 2048-byte chunk that is read from /dev/log, as you can see from the 
test below.  In other words it does not stop processing the 2048-byte 
chunk of data when it reaches the first null byte.  This means that the 
first log entry after startup is processed correctly, but then all sorts 
of random things start to happen, including blank (other than date stamp 
and host name) messages to every connected terminal.

I used gcc-3.4.3, glib-2.24.2, popt 1.16, and pkgconfig 0.25 from the 
HP-UX Porting and Archive Centre to compile it.

Have I overlooked something obvious here?  I can't see any other similar 
reports on this mailing list or in the wild.

I'd appreciate any suggestions!  Regards,

Scott.

P.S. It's a little confusing that the HP-UX notes in the INSTALL file and 
the contrib/syslog-ng.conf.HP-UX files disagree with each other about the 
source syntax; will these be reconciled in a future release?

# nohup /usr/local/sbin/syslog-ng --debug --foreground --stderr > 
syslog-ng.out 2>&1 &
# logger -p user.notice "a user.notice test"
# grep Incoming syslog-ng.out | head
Incoming log entry; line='<13>Sep  6 05:16:52 syslog: a user.notice test'
Incoming log entry; line='L\x84yD'
Incoming log entry; line='\x01'
Incoming log entry; line='\x01'
Incoming log entry; line='\x01'
Incoming log entry; line='\x09'
Incoming log entry; line='\x01\x90T'
Incoming log entry; line='\xd1\x9d'
Incoming log entry; line='h\x0f\x1c,h\x0f\x1c\x98@'
Incoming log entry; line='[Hh\x0dG\xc4h\x0dG\xc4\xc0\x1d?K\xc0\x1d?\x93'
# /usr/local/sbin/syslog-ng -V
syslog-ng 3.1.2
Installer-Version: 3.1.2
Revision: 
ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca
Compile-Date: Sep  6 2010 01:21:23
Enable-Threads: off
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-Sun-STREAMS: off
Enable-Sun-Door: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: on
Enable-SSL: on
Enable-SQL: off
Enable-Linux-Caps: off
Enable-Pcre: off
# cat /usr/local/etc/syslog-ng.conf
@version: 3.0
# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on HP-UX. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(8) for more information.
#
# 20000925 gb at sysfive.com

options { time_reopen (10);
          log_fifo_size (1000);
          long_hostnames (off);
          use_dns (no);
          use_fqdn (no);
          create_dirs (no);
          keep_hostname (yes);
        };

# default contrib'd version
# source s_sys { pipe("/dev/log"); internal(); };

# recommended by INSTALL
source s_sys { pipe("/dev/log" pad_size(2048)); };

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/adm/syslog/syslog.log"); };
destination d_mail { file("/var/adm/syslog/mail.log"); };
destination d_mlrt { usertty("root"); };
destination d_mlal { usertty("*"); };

filter f_filter1   { facility(mail) and level(debug); };
filter f_filter2   { (facility(mail) and level(debug)) or
                     level(info); };
filter f_filter3   { level(alert); };
filter f_filter4   { level(emerg); };

log { source(s_sys); filter(f_filter1); destination(d_mail); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_cons);
                                        destination(d_mlrt); };
log { source(s_sys); filter(f_filter4); destination(d_mlal); };
#



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100906/aa4969f1/attachment.htm