mmgrok looks like it is copying the msg data into the "instance" structure erroneously

[portante]

Seems like mmgrok is not working quite like the way we'd want it to work.

At line https://github.com/rsyslog/rsyslog/blob/master/contrib/mmgrok/mmgrok.c#L163, it seems that the instanceData data structure pszSource field is initialized with the configured value, e.g. msg (one could reference a JSON property, like "!myfield", just as well).

However, as we process messages, it appears that one line https://github.com/rsyslog/rsyslog/blob/master/contrib/mmgrok/mmgrok.c#L351, we overwrite the instanceData structure's pszSource field with the actual message buffer data.

Maybe I am reading this wrong, but why does it just pass that data as a parameter instead?

[rgerhards]

I am not sure if the contributor is following the github issue trackers. It might be better to mail him directly.

[rgerhards]

@portante Is there still interest in this issue tracker? I just had a look at it and I agree that it is wrong. I also have seen that strtok() is used, which is not thread-safe. So the module will potentially make rsyslog segfault.

Given the fact that besides this tracker here we never received any attention regarding mmgrok, I wonder it if it really is useful to try to make it behave differently (except for strtok() for reliability reasons).