From nobody@FreeBSD.org  Wed Feb  4 17:24:18 2004
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3E7B116A4CE
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  4 Feb 2004 17:24:18 -0800 (PST)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 74A1243D4C
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  4 Feb 2004 17:24:17 -0800 (PST)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.12.10/8.12.10) with ESMTP id i151OHdL048273
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 4 Feb 2004 17:24:17 -0800 (PST)
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.12.10/8.12.10/Submit) id i151OHMK048256;
	Wed, 4 Feb 2004 17:24:17 -0800 (PST)
	(envelope-from nobody)
Message-Id: <200402050124.i151OHMK048256@www.freebsd.org>
Date: Wed, 4 Feb 2004 17:24:17 -0800 (PST)
From: Erik Kline <kline@netapp.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: 5.2-RELEASE syslog.conf appears to be malformed
X-Send-Pr-Version: www-2.0

>Number:         62368
>Category:       conf
>Synopsis:       5.2-RELEASE syslog.conf appears to be malformed
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Feb 04 17:30:13 PST 2004
>Closed-Date:    Mon Feb 09 00:18:50 PST 2004
>Last-Modified:  Mon Feb 09 00:18:50 PST 2004
>Originator:     Erik Kline
>Release:        5.2-RELEASE
>Organization:
Network Appliance
>Environment:
FreeBSD hobgoblin.lab.netapp.com 5.2-RELEASE FreeBSD 5.2-RELEASE #0: Sun Jan 11 06:09:12 GMT 2004     root@bobbi.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  sparc64

>Description:
/etc/syslog.conf contains the following lines at the tail end of the file:

!startslip
*.*                                             /var/log/slip.log
!ppp
*.*                                             /var/log/ppp.log

These don't appear to be syntactically valid. Any entries appended after these aren't parsed and processed. CVSup today (04 Feb 2004) shows that /usr/src/etc/syslog.conf remains malformed.

>How-To-Repeat:

>Fix:

>Release-Note:
>Audit-Trail:

From: Pat Lashley <patl+freebsd@volant.org>
To: Erik Kline <kline@netapp.com>, freebsd-gnats-submit@FreeBSD.org
Cc:  
Subject: Re: conf/62368: 5.2-RELEASE syslog.conf appears to be malformed
Date: Wed, 04 Feb 2004 17:58:59 -0800

 --On Wednesday, February 04, 2004 17:24:17 -0800 Erik Kline <kline@netapp.com> wrote:
 
 >> Number:         62368
 >> Category:       conf
 >> Synopsis:       5.2-RELEASE syslog.conf appears to be malformed
 >
 >> Description:
 > /etc/syslog.conf contains the following lines at the tail end of the file:
 >
 > !startslip
 > *.*                                             /var/log/slip.log
 > !ppp
 > *.*                                             /var/log/ppp.log
 >
 > These don't appear to be syntactically valid. Any entries appended
 > after these aren't parsed and processed. CVSup today (04 Feb 2004)
 > shows that /usr/src/etc/syslog.conf remains malformed.
 
 man syslog.conf:
 
      Each block of lines is separated from the previous block by a program or
      hostname specification.  A block will only log messages corresponding to
      the most recent program and hostname specifications given.  Thus, with a
      block which selects `ppp' as the program, directly followed by a block
      that selects messages from the hostname `dialhost', the second block will
      only log messages from the ppp(8) program on dialhost.
 
      A program specification is a line beginning with `#!prog' or `!prog' (the
      former is for compatibility with the previous syslogd, if one is sharing
      syslog.conf files, for example) and the following blocks will be associ-
      ated with calls to syslog(3) from that specific program.  A program spec-
      ification for `foo' will also match any message logged by the kernel with
      the prefix `foo: '.  The `#!+prog' or `!+prog' specification works just
      like the previous one, and the `#!-prog' or `!-prog' specification will
      match any message but the ones from that program.  A hostname specifica-
      tion of the form `#+hostname' or `+hostname' means the following blocks
      will be applied to messages received from the specified hostname.  Alter-
      natively, the hostname specification `#-hostname' or `-hostname' causes
      the following blocks to be applied to messages from any host but the one
      specified.  If the hostname is given as `@', the local hostname will be
      used.  A program or hostname specification may be reset by giving the
      program or hostname as `*'.
 
 The reason that lines added after that point don't appear to be
 parsed or processed is that they apply only to messages from programs
 named 'ppp'.
 
 
 
 -Pat

From: "Kline, Erik" <Erik.Kline@netapp.com>
To: "Pat Lashley" <patl+freebsd@volant.org>
Cc: <freebsd-gnats-submit@FreeBSD.org>
Subject: Re: conf/62368: 5.2-RELEASE syslog.conf appears to be malformed
Date: Wed, 4 Feb 2004 18:05:32 -0800

 This is a multi-part message in MIME format.
 
 ------_=_NextPart_001_01C3EB8C.896BD480
 Content-Type: text/plain;
 	charset="iso-8859-1"
 Content-Transfer-Encoding: quoted-printable
 
 
 so when writing scripts that make custom mods to syslog.conf I need to
 cat >> /etc/syslog.conf something like:
 
 !*
 local2.info		@some.log.host
 
 Is this correct? Thanks for pointing out the section of the man page I
 didn't quite get down to!
 
 On Wed, 4 Feb 2004, Pat Lashley wrote:
 
 > --On Wednesday, February 04, 2004 17:24:17 -0800 Erik Kline =
 <kline@netapp.com> wrote:
 >
 > >> Number:         62368
 > >> Category:       conf
 > >> Synopsis:       5.2-RELEASE syslog.conf appears to be malformed
 > >
 > >> Description:
 > > /etc/syslog.conf contains the following lines at the tail end of the =
 file:
 > >
 > > !startslip
 > > *.*                                             /var/log/slip.log
 > > !ppp
 > > *.*                                             /var/log/ppp.log
 > >
 > > These don't appear to be syntactically valid. Any entries appended
 > > after these aren't parsed and processed. CVSup today (04 Feb 2004)
 > > shows that /usr/src/etc/syslog.conf remains malformed.
 >
 > man syslog.conf:
 >
 >      Each block of lines is separated from the previous block by a =
 program or
 >      hostname specification.  A block will only log messages =
 corresponding to
 >      the most recent program and hostname specifications given.  Thus, =
 with a
 >      block which selects `ppp' as the program, directly followed by a =
 block
 >      that selects messages from the hostname `dialhost', the second =
 block will
 >      only log messages from the ppp(8) program on dialhost.
 >
 >      A program specification is a line beginning with `#!prog' or =
 `!prog' (the
 >      former is for compatibility with the previous syslogd, if one is =
 sharing
 >      syslog.conf files, for example) and the following blocks will be =
 associ-
 >      ated with calls to syslog(3) from that specific program.  A =
 program spec-
 >      ification for `foo' will also match any message logged by the =
 kernel with
 >      the prefix `foo: '.  The `#!+prog' or `!+prog' specification =
 works just
 >      like the previous one, and the `#!-prog' or `!-prog' =
 specification will
 >      match any message but the ones from that program.  A hostname =
 specifica-
 >      tion of the form `#+hostname' or `+hostname' means the following =
 blocks
 >      will be applied to messages received from the specified hostname. =
  Alter-
 >      natively, the hostname specification `#-hostname' or `-hostname' =
 causes
 >      the following blocks to be applied to messages from any host but =
 the one
 >      specified.  If the hostname is given as `@', the local hostname =
 will be
 >      used.  A program or hostname specification may be reset by giving =
 the
 >      program or hostname as `*'.
 >
 > The reason that lines added after that point don't appear to be
 > parsed or processed is that they apply only to messages from programs
 > named 'ppp'.
 >
 >
 >
 > -Pat
 >
 
 ------_=_NextPart_001_01C3EB8C.896BD480
 Content-Type: text/html;
 	charset="iso-8859-1"
 Content-Transfer-Encoding: quoted-printable
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
 <HTML>
 <HEAD>
 <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
 charset=3Diso-8859-1">
 <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
 6.0.6249.1">
 <TITLE>Re: conf/62368: 5.2-RELEASE syslog.conf appears to be =
 malformed</TITLE>
 </HEAD>
 <BODY>
 <!-- Converted from text/plain format -->
 <BR>
 
 <P><FONT SIZE=3D2>so when writing scripts that make custom mods to =
 syslog.conf I need to</FONT>
 
 <BR><FONT SIZE=3D2>cat &gt;&gt; /etc/syslog.conf something like:</FONT>
 </P>
 
 <P><FONT SIZE=3D2>!*</FONT>
 
 <BR><FONT SIZE=3D2>local2.info&nbsp;&nbsp;&nbsp;&nbsp; =
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @some.log.host</FONT>
 </P>
 
 <P><FONT SIZE=3D2>Is this correct? Thanks for pointing out the section =
 of the man page I</FONT>
 
 <BR><FONT SIZE=3D2>didn't quite get down to!</FONT>
 </P>
 
 <P><FONT SIZE=3D2>On Wed, 4 Feb 2004, Pat Lashley wrote:</FONT>
 </P>
 
 <P><FONT SIZE=3D2>&gt; --On Wednesday, February 04, 2004 17:24:17 -0800 =
 Erik Kline &lt;kline@netapp.com&gt; wrote:</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;&gt; =
 Number:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 62368</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;&gt; =
 Category:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; conf</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;&gt; =
 Synopsis:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5.2-RELEASE syslog.conf =
 appears to be malformed</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;&gt; Description:</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; /etc/syslog.conf contains the following =
 lines at the tail end of the file:</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; !startslip</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; =
 *.*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
 p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
 ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
 /var/log/slip.log</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; !ppp</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; =
 *.*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
 p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
 ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /var/log/ppp.log</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; These don't appear to be syntactically =
 valid. Any entries appended</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; after these aren't parsed and processed. =
 CVSup today (04 Feb 2004)</FONT>
 
 <BR><FONT SIZE=3D2>&gt; &gt; shows that /usr/src/etc/syslog.conf remains =
 malformed.</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; man syslog.conf:</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Each block of =
 lines is separated from the previous block by a program or</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; hostname =
 specification.&nbsp; A block will only log messages corresponding =
 to</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the most recent =
 program and hostname specifications given.&nbsp; Thus, with a</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; block which =
 selects `ppp' as the program, directly followed by a block</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; that selects =
 messages from the hostname `dialhost', the second block will</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; only log messages =
 from the ppp(8) program on dialhost.</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; A program =
 specification is a line beginning with `#!prog' or `!prog' (the</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; former is for =
 compatibility with the previous syslogd, if one is sharing</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; syslog.conf files, =
 for example) and the following blocks will be associ-</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ated with calls to =
 syslog(3) from that specific program.&nbsp; A program spec-</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ification for =
 `foo' will also match any message logged by the kernel with</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the prefix `foo: =
 '.&nbsp; The `#!+prog' or `!+prog' specification works just</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; like the previous =
 one, and the `#!-prog' or `!-prog' specification will</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; match any message =
 but the ones from that program.&nbsp; A hostname specifica-</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tion of the form =
 `#+hostname' or `+hostname' means the following blocks</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; will be applied to =
 messages received from the specified hostname.&nbsp; Alter-</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; natively, the =
 hostname specification `#-hostname' or `-hostname' causes</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the following =
 blocks to be applied to messages from any host but the one</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; specified.&nbsp; =
 If the hostname is given as `@', the local hostname will be</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; used.&nbsp; A =
 program or hostname specification may be reset by giving the</FONT>
 
 <BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; program or =
 hostname as `*'.</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; The reason that lines added after that point =
 don't appear to be</FONT>
 
 <BR><FONT SIZE=3D2>&gt; parsed or processed is that they apply only to =
 messages from programs</FONT>
 
 <BR><FONT SIZE=3D2>&gt; named 'ppp'.</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 
 <BR><FONT SIZE=3D2>&gt; -Pat</FONT>
 
 <BR><FONT SIZE=3D2>&gt;</FONT>
 </P>
 
 </BODY>
 </HTML>
 ------_=_NextPart_001_01C3EB8C.896BD480--
State-Changed-From-To: open->closed 
State-Changed-By: dwmalone 
State-Changed-When: Mon Feb 9 00:17:50 PST 2004 
State-Changed-Why:  
Seems to have been a misunderstanding of program based filtering. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=62368 
>Unformatted:
