-
Notifications
You must be signed in to change notification settings - Fork 490
Closed
Labels
Description
When using $(format-json key ="value")
syntax, there is a space before the =
, syslog-ng will do a nullprt deref when trying to format the message.
Note: that the template will create the message: {"key":""}
value when using it like: $(format-json key= "value")
.
The config I used:
@include "scl.conf"
source s_syslog_file {
file(
"/opt/src.txt"
flags(syslog-protocol)
);
};
destination d_azure {
file(
"/opt/dst.txt"
template('$(format-json key ="value")')
);
};
log {
source(s_syslog_file);
destination(d_azure);
};
The message I used to test it:
<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8
The backtrace os thw coredump using the docker.io/balabit/syslog-ng:latest
docker image:
0x00007404ab70cc77 in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
(gdb) bt
#0 0x00007404ab70cc77 in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#1 0x00007404ab77a2e5 in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#2 0x00007404ab60758c in g_tree_foreach () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3 0x00007404ab77b56e in value_pairs_foreach_sorted () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#4 0x00007404ab77b693 in value_pairs_walk () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#5 0x00007404a8f0fdc4 in ?? () from /usr/lib/syslog-ng/4.8/libjson-plugin.so
#6 0x00007404ab7782d1 in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#7 0x00007404ab77850b in log_template_append_format_value_and_type_with_context () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#8 0x00007404ab778a97 in log_template_append_format_value_and_type () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#9 0x00007404ab7296b7 in log_writer_format_log () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#10 0x00007404ab72a4b7 in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#11 0x00007404ab72aa2a in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#12 0x00007404ab72d436 in ?? () from /usr/lib/syslog-ng/libsyslog-ng-4.8.so.0
#13 0x00007404ab2d187c in ?? () from /lib/x86_64-linux-gnu/libivykis.so.0
#14 0x00007404ab2d0020 in ?? () from /lib/x86_64-linux-gnu/libivykis.so.0
#15 0x00007404ab2d6c65 in ?? () from /lib/x86_64-linux-gnu/libivykis.so.0
#16 0x00007404ab2d27d9 in ?? () from /lib/x86_64-linux-gnu/libivykis.so.0
#17 0x00007404ab2d3e89 in iv_main () from /lib/x86_64-linux-gnu/libivykis.so.0
#18 0x00007404ab2d1642 in ?? () from /lib/x86_64-linux-gnu/libivykis.so.0
#19 0x00007404ab2d51d9 in ?? () from /lib/x86_64-linux-gnu/libivykis.so.0
#20 0x00007404ab4186c2 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#21 0x00007404ab493128 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78