[syslog-ng] Bug in rewrite logic, 3.3.3

[Patrick H.]

Sent: Tue Nov 29 2011 18:42:05 GMT-0700 (MST)
From: Dave Rawks <dave at pandora.com>
To: syslog-ng at lists.balabit.hu
Subject: [syslog-ng] Bug in rewrite logic, 3.3.3
> I've got two different log paths defined that have the same rewrite
> included in them. The second log path always causes the rewrite to
> overwrite the incorrect macro value.
>
>
> If the above configuration is used the events that pass through the
> second log path have their MESSAGE macro overwritten as "0" instead of
> their PID macro as is defined in the r_no_pid rewrite rule. The events
> that pass through the first logpath behave as expected. If I comment out
> the first logpath then the second behaves as expected.
>
> -Dave

Found this bug the other day as well. Bazsi pointed out that its already 
been fixed :-)


commit 1b52fd8741b33c20e7cdc06b907fb76a981c8874
Author: Balazs Scheidler<bazsi at balabit.hu>
Date:   Fri Nov 25 12:38:40 2011 +0100

     [logrewrite] Repair logrewrite *_clone and *_subst_clone functions (fixes: #7686)

     Repair rewrite clone functions because we did not clone $MACRO id and conditions.
     Before this patch if we used rewrite in config file and use example PIPE source
     we rewrited $MESSAGE macro instead of macro in config file because the $MESSAGE
     macro was the default macro.

     Signed-off-by: Fried Zoltan<deirf at balabit.hu>
     Signed-off-by: Balazs Scheidler<bazsi at balabit.hu>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20111129/53000bfe/attachment-0001.htm