1 # This patch is a fix for proper uncompression 

     2 # source: written internally

     3 # Should be sent upstream, but hasn't been.

     4 # Bug has existed a long time (probably since rsyslog implemented compression),

     5 # last noticed in 8.4.0

     6 --- rsyslog/runtime/parser.c	2014-08-18 02:14:06.000000000 -0700

     7 +++ rsyslog/runtime/parser.c	2014-09-18 14:46:49.068679264 -0700

     8 @@ -336,8 +336,10 @@

     9  

    10  	/* we first need to check if we have a compressed record. If so,

    11  	 * we must decompress it.

    12 +	 * If NO_PRI_IN_RAW is set, this is a local Solaris message and

    13 +	 * therefore not compressed (though it may well begin with 'z'!).

    14  	 */

    15 -	if(lenMsg > 0 && *pszMsg == 'z') { /* compressed data present? (do NOT change order if conditions!) */

    16 +	if(lenMsg > 0 && *pszMsg == 'z' && pMsg->msgFlags & NO_PRI_IN_RAW == 0) { /* compressed data present? (do NOT change order if conditions!) */

    17  		/* we have compressed data, so let's deflate it. We support a maximum

    18  		 * message size of iMaxLine. If it is larger, an error message is logged

    19  		 * and the message is dropped. We do NOT try to decompress larger messages