(RADIATOR) Incomplete entries in syslog

[Jan Tomasek]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,
sometimes I'm getting in syslog messages like this:

Aug 23 11:13:14 radius1 PAM_unix[6286]: (cron) session closed for user root
Aug 23 11:13:30 radius1 )H<238>u<251><164>h9"   NAS-IP-Address = 195.113.187.19
Aug 23 11:14:01 radius1 PAM_unix[6291]: (cron) session opened for user root by
(uid=0)

at first moment I was thinking that it's some bug in logcheck (messing
radiator log file), but after detailed check I see that it is some corrupted
log message from radiator. My complete syslog-ng configuration is attached. It
is simple, few facilities are going to separate log files and rest is going to
 message log file. In that log file I sometimes found this fragments...

If I try to find that entry in radiator log file:
	radius1:/var/log# grep 11:13:[0-9][0-9] radius  |grep '<164>'
it simply isn't there. It looks it is lost, only that fragment in messages file.

I'm using this configuration:

<Log SYSLOG>
                Facility        local7
                LogIdent        radiator
                Trace           4
</Log>
<Log FILE>
                Filename        /var/log/radiator-file
                LogIdent        radiator-file
                Trace           4
</Log>

I just now added <Log FILE> to be able observe if entry gets messed in
Radiator itself or somewhere between Radiator and syslog-ng. I will be very
thankfull if you can give me some hints about this. Has anyone experienced
such problem?

Best regards
- --
- --------------------------------------------------------------
Jan Tomasek aka Semik           work: CESNET, z.s.p.o.
http://www.tomasek.cz/                Zikova 4, 160 00 Praha 6
                                      Czech Republic
phone(work): +420 2 2435 5279         http://www.cesnet.cz/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBKeHq79++DGvj6tMRAowSAJ9eJL5032RuKzuZeiVyzhzLfX3eAQCgm8hA
j//2WZHO5/+uunOUGjiwzrY=
=NG2J
-----END PGP SIGNATURE-----
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: syslog-ng.conf
URL: <http://www.open.com.au/pipermail/radiator/attachments/20040823/c9426f95/attachment.ksh>