balabit/syslog-ng — pull request #22 by algernon (2013-11-25 17:55:09+00:00)
Title: syslogformat: Only set PROGRAM to kernel when the message is local

When the message is not local, do not override - or set - the value of
PROGRAM, there's other ways to do that. Doing an unconditional setting
breaks setups where kernel messages are forwarded between syslog-ng
instances:

The first syslog-ng sees "<4>Some message..." on /proc/kmsg, sets
PROGRAM to "kernel", and sends it over on tcp as "<4>kernel: Some
message...". The second syslog-ng sees that, from the facility it sees
that it's a kernel message, and sets PROGRAM to kernel again.

But when a message is from the kernel, we don't parse the rest, we don't
extract the program, we treat the rest of the message as MESSAGE, so in
this case, we'd end up with "<4>kernel: kernel: Some message", and each
hop would add another "kernel: ".

If we only set this when the message is local, we avoid this. The
downside is, that on the remote end, PROGRAM will not be set.

Reported-by: Matyas Koszik
Signed-off-by: Gergely Nagy