From f112b51b8d6c358b87ac608112d393adb047ea0f Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 20 Dec 2011 16:39:39 +0100 Subject: bugfix: imuxsock did truncate part of received message if it did not contain a proper date. The truncation occured because we removed that part of the messages that was expected to be the date. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295 --- plugins/imuxsock/imuxsock.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'plugins') diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 2697c48a..feddb20c 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -565,8 +565,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred) parse++; lenMsg--; /* '>' */ if((pLstn->flags & IGNDATE)) { - parse += 16; /* just skip timestamp */ - lenMsg -= 16; + /* in this case, we still need to find out if we have a valid + * datestamp or not .. and advance the parse pointer accordingly. + */ + struct syslogTime dummy; + datetime.ParseTIMESTAMP3164(&dummy, &parse, &lenMsg); } else { if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &parse, &lenMsg) != RS_RET_OK) { DBGPRINTF("we have a problem, invalid timestamp in msg!\n"); -- cgit