bugfix: trailing ":" of tag was lost while parsing legacy syslog messages

    without timestamp - thanks to Anders Blomdell for providing a patch!

2 files changed, 5 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index b2e459d2..d3f933a6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,8 @@ Version 3.11.1 (rgerhards), 2008-02-??
 - added x-info field to rsyslogd startup/shutdown message. Hopefully
   points users to right location for further info (many don't even know
   they run rsyslog ;))
+- bugfix: trailing ":" of tag was lost while parsing legacy syslog messages
+  without timestamp - thanks to Anders Blomdell for providing a patch!
 ---------------------------------------------------------------------------
 Version 3.11.0 (rgerhards), 2008-01-31
 - implemented queued actions
diff --git a/syslogd.c b/syslogd.c
index e87e99a3..7434c8b7 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -2042,7 +2042,9 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags)
 			 */
 			if(*p2parse == ':') {
 				bTAGCharDetected = 1;
-				++p2parse;
+				/* We will move hostname to tag, so preserve ':' (otherwise we 
+				 * will needlessly change the message format) */
+				*pWork++ = *p2parse++; 
 			} else if(*p2parse == ' ')
 				++p2parse;
 			*pWork = '\0';