[asterisk-bugs] [Asterisk 0010871]: Logging goes to wrong destination

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10871 
====================================================================== 
Reported By:                non-poster
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10871
Category:                   General
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.11  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             10-02-2007 14:18 CDT
Last Modified:              10-02-2007 14:55 CDT
====================================================================== 
Summary:                    Logging goes to wrong destination
Description: 
Some log messages show up in /var/log/messages on my machine.

Code:
# grep -v ^\; /etc/asterisk/logger.conf

[general]
[logfiles]
syslog.local0 => notice,warning,error,verbose,debug


/etc/syslog-ng/syslog-ng.conf:

filter f_asterisk { program(asterisk); };
destination asterisk { file("/var/log/asterisk/messages"); };
log { source(src); filter(f_asterisk); destination(asterisk); };

destination messages { file("/var/log/messages"); };
filter f_messages { not facility(auth,authpriv,kern,mail,daemon) and
                                        ...
                                        not program(asterisk) and
                                        ...
                                        ;
                                        };
log { source(src); filter(f_messages); destination(messages); };


The messages:

Oct  1 18:39:04 myhostname unparseable log message: "<--- Transmitting
(NAT) to 192.168.49.99:55954 --- >"
Oct  1 18:39:04 myhostname SIP/2.0 401 Unauthorized
Oct  1 18:39:04 myhostname Via: SIP/2.0/UDP
192.168.49.99:55954;branch=z9hG4bK-d87543-71067059a5075507-1--d87543-;received=192.168.49.99;rport=55954
Oct  1 18:39:04 myhostname From:
"myhostname"<sip:6100 at myhostname.com>;tag=407c2746
Oct  1 18:39:04 myhostname To:
"myhostname"<sip:6100 at myhostname.com>;tag=as7a8d5495
Oct  1 18:39:04 myhostname Call-ID:
MzQ0ZmE5Nzg5MjI0ZWQxYjJkNGFiZjFhYzk1YWI0OGQ.  CSeq: 3 REGISTER  User-Agent:
Asterisk PBX  Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE,
NOTIFY  Supported: replaces  WWW-Authenticate: Digest algorithm=MD5,
realm="myhostname.com", nonce="24e57166"  Content-Length: 0    
<------------>
Oct  1 18:53:46 myhostname HTTP/1.1 404 Not Found  Content-Type: text/html
 Content-Length: 345  Date: Tue, 02 Oct 2007 01:53:46 GMT  Server:
lighttpd/1.4.18
Oct  1 19:27:35 myhostname unparseable log message: "<--- Transmitting
(NAT) to 192.168.48.100:5060 --- >"
Oct  1 19:27:35 myhostname SIP/2.0 100 Trying
Oct  1 19:27:35 myhostname Via: SIP/2.0/UDP
myhostname.com;branch=z9hG4bKpqqzyktg;received=192.168.48.100;rport=5060 
From: "non-poster" <sip:nonposter at myhostname.com>;tag=sgmhb  To:
<sip:18003733411 at myhostname.com>  Call-ID: totikozjpilfjfs at myhostname.com 
CSeq: 100 INVITE  User-Agent: Asterisk PBX  Allow: INVITE, ACK, CANCEL,
OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY  Supported: replaces  Contact:
<sip:18003733411 at 192.168.48.1>  Content-Length: 0     <------------>



The "unparseable log message" comes from syslog-ng.



Asterisk 1.4.11, gcc 4.1.2, glibc 2.5, amd64
====================================================================== 

---------------------------------------------------------------------- 
 non-poster - 10-02-07 14:55  
---------------------------------------------------------------------- 
Yes, asterisk should (and does) send everything to syslog.  However, my
syslog rule should send everything that asterisk logs to
/var/log/asterisk/messages, and most log entries do, except this one still
goes to /var/log/messages, and syslog notes that it is unparseable.  None
of the other services on my system have ever caused syslog to log an
"unparseable" message. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
10-02-07 14:55  non-poster     Note Added: 0071354                          
======================================================================