From c60a16ba8fa2a57af23f7653fd2316c26e06c577 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 28 Jul 2025 00:23:21 +0900 Subject: [PATCH] journal: check filtering after parsing timestamp, identifier, pid, and so on Otherwise, filtering regex with '^' does not work. Fixes a bug in 87a13dabbd81c2e31fd5ac7b81cce61baf23e59c (v253). Fixes #38361. --- src/journal/journald-syslog.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c index 8e9c0e2b402..277146d5932 100644 --- a/src/journal/journald-syslog.c +++ b/src/journal/journald-syslog.c @@ -392,9 +392,6 @@ void manager_process_syslog_message( if (!client_context_test_priority(context, priority)) return; - if (client_context_check_keep_log(context, msg, strlen(msg)) <= 0) - return; - syslog_ts = msg; syslog_ts_len = syslog_skip_timestamp(&msg); if (syslog_ts_len == 0) @@ -403,6 +400,9 @@ void manager_process_syslog_message( syslog_parse_identifier(&msg, &identifier, &pid); + if (client_context_check_keep_log(context, msg, strlen(msg)) <= 0) + return; + if (m->config.forward_to_syslog) forward_syslog_raw(m, priority, buf, raw_len, ucred, tv); -- 2.47.3