On Mon, 2 Jun 2014 10:25:40 -0700 (PDT) Chris Stromsoe <[email protected]> wrote:
> logtail2 does not do any sanity checking on the final line of input to > make sure that it is complete and "\n" terminated. If syslog is not set > to flush on every write, it's possible for consecutive runs of logcheck to > get a single log entry split in half for each run, resulting in false > positives from logcheck. Is this still an issue in 2024? if not we could close this old bug. If you ran logtail2 on a non-syslog file (which might actually be an increasingly common usage in a systemd world?), then ignoring a line without a trailing \n means that last line might never be checked, which seems far worse than the occasional false-positive. I dont think i ever saw such false positives with rsyslog, when i used it.
