Bug#343243: [dws@ee.ethz.ch: Bug#343243: Fails to parse some lines]

[Niko Tyni]

On Sun, Jan 01, 2006 at 05:51:55PM -0500, Anthony DeRobertis wrote:
> 
> > The problem is that apparently the hostname is missing.
> > 
> > You have:
> > 
> >   Dec 12 21:00:00 tsync: time updated 
> > 
> > It should be:
> > 
> >   Dec 12 21:00:00 HOST tsync: time updated 
> 
> Yeah... This the normal syslogd from RedHat 7.0. Nothing special in the
> config; oddly enough, it only affects that one program.

Hi,

could you elaborate a bit? Do you mean that the message was received by
a Redhat 7.0 host, and you're just postprocessing the log on a Debian
box? Or was it forwarded by the Redhat syslogd to a Debian syslogd
(which one)?

I have played a bit with the sysklogd in Debian (sarge), and I couldn't get
it to log a message without prepending the 'HOST' part. OTOH, the sysklogd
in Redhat 7.0 is ancient, and could well have such a bug.

Anyway, I think the line can be considered broken, and I don't think
Parse::Syslog should be expected to handle it. If it was generated by
a Debian syslogd, this Debian bug should IMO be reassigned against it.

Cheers,
-- 
Niko Tyni		ntyni at iki.fi