[syslog-ng] Problem with program_override in upgrade from 3.0.8 to 3.2.4

[Balazs Scheidler]

On Mon, 2011-08-08 at 17:04 +0200, Javi Polo wrote:
> El 08/06/2011 06:56 PM, Balazs Scheidler escribió:
> >> As you can see, the program_name has dissapeared
> >> I suspect is a bug, but I'm not sure as there might be some change in
> >> syslog-ng behaviour that I did miss :?
> > flags(dont-store-legacy-msghdr)
> >
> > I wanted to explain why, but I'm in a hurry, probably in an upcoming
> > post. (the flag might be called no-store-..., can't remember exactly)
> 
> Thanks!
> I found an explanation there 
> http://bazsi.blogs.balabit.com/2010/05/small-incompatible-change-for-3-1/
> 
> However, it still doesnt work
> As the flag 'dont-store-legacy-msghdr' is set on the 'source' statement 
> in the logserver host, it seems it doesnt affect the syslog-ng 
> generating the log, which stripes the program from the log-line
> 
> I tried to put 'dont-store-legacy-msghdr' flag in the originating host, 
> under 'destination' statement, but syslog-ng complains that the flag is 
> invalid there ...
> 
> I have switched back to syslog-ng 3.0 till I can resolve this issue
> 

you need the flag on the host that has program-override(),
program-override() will not work if store-legacy-msghdr is enabled,
unless the destination template is customized too.

If the client syslog-ng has program-override(), then you need the flag
on that host, on its source statement.

-- 
Bazsi