On 11/29/2012 03:49 PM, [email protected] wrote:
Hi all,
following this thread of the forum :
http://kb.monitorware.com/post22948.html#p22948 , would it be possible to
integrate the following patch in the trunk ?
The only thing it does is to try the RFC3339 timestamp format on top of the
old one for logs coming through the unix socket.
Hi,
it seems I've hit a bug related to this. There's a string length
decrement missing in ParseTIMESTAMP3339() with these symptoms:
input to imuxsock: <133>2012-12-10T16:47:28.229278+01:00 1234 5678 90ab
message in log file: Dec 10 16:47:28 rawhide 1234 4 5678 90ab
Correcting the string length seemed to fix it and I didn't pursue why it
generated this specific artifact. Patch is attached.
Tomas
>From 0721b1cb5d16ccea5cb455b24dbc66556a604845 Mon Sep 17 00:00:00 2001
From: Tomas Heinrich <[email protected]>
Date: Wed, 9 Jan 2013 19:19:48 +0100
Subject: [PATCH] bugfix: decrement string length
---
runtime/datetime.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/runtime/datetime.c b/runtime/datetime.c
index 7d97447..e839bf1 100644
--- a/runtime/datetime.c
+++ b/runtime/datetime.c
@@ -305,8 +305,10 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS, int *pLenStr)
if(OffsetHour < 0 || OffsetHour > 23)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
- if(lenStr == 0 || *pszTS++ != ':')
+ if(lenStr == 0 || *pszTS != ':')
ABORT_FINALIZE(RS_RET_INVLD_TIME);
+ --lenStr;
+ pszTS++;
OffsetMinute = srSLMGParseInt32(&pszTS, &lenStr);
if(OffsetMinute < 0 || OffsetMinute > 59)
ABORT_FINALIZE(RS_RET_INVLD_TIME);
--
1.7.10.4
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
