[syslog-ng] [Bug 165] macro sequenceId is empty

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=165


Balazs Scheidler <bazsi at balabit.hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|                            |FIXED
             Status|NEW                         |RESOLVED




--- Comment #1 from Balazs Scheidler <bazsi at balabit.hu>  2012-03-18 13:21:17 ---
that value is only set in the following cases:

1) the incoming message is coming from a remote server and it had this information in the first place (e.g. it was RFC5424 formatted and had this SDATA)

2) the message is received from a local log transport (e.g. /dev/log)

However there were two issues with the option 2 above, fixed by these patches:

Author: Balazs Scheidler <bazsi at balabit.hu>  2011-09-21 14:11:33
Committer: Balazs Scheidler <bazsi at balabit.hu>  2011-09-23 12:09:22
Parent: 6b62ae6610d659024787339c61335bcbf192120e (dbparser/test_radix: added negative testcases)
Child:  6bb06e868d393d17ec0c5682b229b18d660d8553 (LogWriter: initialize the SEQNUM value to 1 in the constructor)
Branches: many (39)
Follows: v3.3.0beta2
Precedes: v3.3.1

    mark locally generated messages as such

    The LF_LOCAL in LogMessage->flags indicates that the message was generated
    locally. This flag was not properly set and this patch fixes that
    issue.

    Signed-off-by: Balazs Scheidler <bazsi at balabit.hu>


Author: Balazs Scheidler <bazsi at balabit.hu>  2011-09-09 15:37:34
Committer: Balazs Scheidler <bazsi at balabit.hu>  2011-09-23 11:44:15
Parent: b835879d1cdab9d06f56d9dfd946198c0308b537 (nvtable: set the minimum size to 128 bytes instead of 256 to avoid breaking the unit tests)
Branches: many (40)
Follows: v3.3.0beta2
Precedes: v3.3.1

    SDATA: include meta.sequenceId value in RFC5424 formatted message

    The code to include meta.sequenceId was commented out some time ago, since
    it modified the message right before sending it out on the wire, effectively
    ruining the message model: this change propagated to parallel branches of
    the processing pipeline where it shouldn't have.

    This change fixes that, instead of modifying the message before formatting
    it with the template, the SDATA payload is automatically extended without having
    to store sequenceId in the message.

    Signed-off-by: Viktor Juhasz <jviktor at balabit.hu>
    Signed-off-by: Balazs Scheidler <bazsi at balabit.hu>


This means that this should work if you are using 3.3.1 (but 3.3.4 is the minimum recommended version).

You can also set the value for this SDATA through a rewrite rule or a parser.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.