[syslog-ng] Output to file in /proc

[Matthew Hall]

On Wed, Mar 02, 2011 at 05:55:54PM +0100, Balazs Scheidler wrote:
> On Wed, 2011-03-02 at 12:28 +0100, Valentijn Sessink wrote:
> > Hi Balázs,
> > 
> >  > LogWriter: added support for a new flag 'ignore-errors'
> > 
> > Unfortunately, I can't get syslog-ng to re-write a broken message, even 
> > with fsync(yes). However, with your patch, it feels safer, because *if* 
> > a blocking message would be there, it would be ignored from now on.
> 
> did you check that with strace?
> 
> I now checked the kernel source, and the recent match really seems to
> error out on invalid formats with EINVAL.
> 
> I'd really like to know what is going on, syslog-ng should try that
> operation again, and it feels like a bug.

Could the problems be prevented by using a PCRE rule to verify the message passes a regex format validity filter before kicking it into the file?

Matthew.