Imported Upstream version 3.14.2upstream/3.14.2

22 files changed, 419 insertions, 600 deletions

diff --git a/ChangeLog b/ChangeLog
index 09fca56..70ef3c0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,24 @@
 ---------------------------------------------------------------------------
+Version 3.14.2 (rgerhards), 2008-04-??
+- bugfix: segfault with expression-based filters
+- bugfix: omsnmp did not deref errmsg object on exit (no bad effects caused)
+- some cleanup
+- bugfix: imklog did not work well with kernel 2.6+. Thanks to Peter
+  Vrabec for patching it based on the development in sysklogd - and thanks
+  to the sysklogd project for upgrading klogd to support the new
+  functionality
+- some cleanup in imklog
+- bugfix: potential segfault in imklog when kernel is compiled without
+  /proc/kallsyms and the file System.map is missing. Thanks to
+  Andrea Morandi for pointing it out and suggesting a fix.
+- bugfixes, credits to varmojfekoj:
+  * reset errno before printing a warning message
+  * misspelled directive name in code processing legacy options
+- bugfix: some legacy options not correctly interpreted - thanks to
+  varmojfekoj for the patch
+- improved detection of modules being loaded more than once
+  thanks to varmojfekoj for the patch
+---------------------------------------------------------------------------
 Version 3.14.1 (rgerhards), 2008-04-04
 - bugfix: some messages were emited without hostname
 - bugfix: rsyslogd was no longer build by default; man pages are 
diff --git a/configure b/configure
index 4b316ca..15a6121 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for rsyslog 3.14.1.
+# Generated by GNU Autoconf 2.61 for rsyslog 3.14.2.
 #
 # Report bugs to <rsyslog@lists.adiscon.com>.
 #
@@ -728,8 +728,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='rsyslog'
 PACKAGE_TARNAME='rsyslog'
-PACKAGE_VERSION='3.14.1'
-PACKAGE_STRING='rsyslog 3.14.1'
+PACKAGE_VERSION='3.14.2'
+PACKAGE_STRING='rsyslog 3.14.2'
 PACKAGE_BUGREPORT='rsyslog@lists.adiscon.com'
 
 ac_unique_file="syslogd.c"
@@ -1437,7 +1437,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures rsyslog 3.14.1 to adapt to many kinds of systems.
+\`configure' configures rsyslog 3.14.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1507,7 +1507,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of rsyslog 3.14.1:";;
+     short | recursive ) echo "Configuration of rsyslog 3.14.2:";;
    esac
   cat <<\_ACEOF
 
@@ -1630,7 +1630,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-rsyslog configure 3.14.1
+rsyslog configure 3.14.2
 generated by GNU Autoconf 2.61
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1644,7 +1644,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by rsyslog $as_me 3.14.1, which was
+It was created by rsyslog $as_me 3.14.2, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   $ $0 $@
@@ -2334,7 +2334,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='rsyslog'
- VERSION='3.14.1'
+ VERSION='3.14.2'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -26443,7 +26443,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by rsyslog $as_me 3.14.1, which was
+This file was extended by rsyslog $as_me 3.14.2, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -26496,7 +26496,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-rsyslog config.status 3.14.1
+rsyslog config.status 3.14.2
 configured by $0, generated by GNU Autoconf 2.61,
   with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 
diff --git a/configure.ac b/configure.ac
index ae388a9..e2bda20 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.61)
-AC_INIT([rsyslog],[3.14.1],[rsyslog@lists.adiscon.com])
+AC_INIT([rsyslog],[3.14.2],[rsyslog@lists.adiscon.com])
 AM_INIT_AUTOMAKE
 AC_CONFIG_SRCDIR([syslogd.c])
 AC_CONFIG_HEADERS([config.h])
diff --git a/ctok.c b/ctok.c
index aaffed3..58a18b4 100644
--- a/ctok.c
+++ b/ctok.c
@@ -165,7 +165,6 @@ ctokGetWordFromStream(ctok_t *pThis, uchar *pWordBuf, size_t lenWordBuf)
 	/* push back the char that we have read too much */
 	CHKiRet(ctokUngetCharFromStream(pThis, c));
 
-dbgprintf("end ctokGetWordFromStream, stream now '%s'\n", pThis->pp);
 finalize_it:
 	RETiRet;
 }
@@ -230,8 +229,6 @@ ctokGetNumber(ctok_t *pThis, ctok_token_t *pToken)
 
 	CHKiRet(var.SetNumber(pToken->pVar, n));
 
-dbgprintf("number, number is: '%lld'\n", n);
-
 finalize_it:
 	RETiRet;
 }
@@ -268,8 +265,6 @@ ctokGetVar(ctok_t *pThis, ctok_token_t *pToken)
 	}
 	CHKiRet(rsCStrFinish(pStrB));
 
-dbgprintf("var, var is: '%s'\n", rsCStrGetSzStr(pstrVal));
-
 	CHKiRet(var.SetString(pToken->pVar, pstrVal));
 	pstrVal = NULL;
 
@@ -320,8 +315,6 @@ ctokGetSimpStr(ctok_t *pThis, ctok_token_t *pToken)
 	}
 	CHKiRet(rsCStrFinish(pStrB));
 
-dbgprintf("simpstr, str is: '%s'\n", rsCStrGetSzStr(pstrVal));
-
 	CHKiRet(var.SetString(pToken->pVar, pstrVal));
 	pstrVal = NULL;
 
diff --git a/doc/manual.html b/doc/manual.html
index 135d2fa..9d4dbef 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -1,6 +1,5 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html><head><title>rsyslog documentation</title>
-
 </head>
 <body>
 <h1>RSyslog - Documentation</h1>
@@ -18,9 +17,10 @@ relay chains while at the same time being very easy to setup for the
 novice user. And as we know what enterprise users really need, there is
 also <a href="professional_support.html">professional
 rsyslog support</a> available directly from the source!</p>
-<p><b>Visit the <i> <a href="status.html">rsyslog
-status page</a></i></b> to obtain current
-version information and ports. <b>If you like rsyslog, you might
+<p><b>This documentation is for version 3.14.2 of rsyslog.</b>
+Visit the <i> <a href="http://www.rsyslog.com/doc-status.html">rsyslog status page</a></i></b> to obtain current
+version information and project status.
+<p><b>If you like rsyslog, you might
 want to lend us a helping hand. </b>It doesn't require a lot of
 time - even a single mouse click helps. Learn <a href="how2help.html">how to help the rsyslog project</a>.
 Due to popular demand, there is now a <a href="rsyslog_ng_comparison.html">side-by-side comparison
@@ -100,4 +100,4 @@ may find
 <a href="http://www.gerhards.net/rainer">Rainer</a>'s
 <a href="http://rgerhards.blogspot.com/">blog</a> an
 interesting read (filter on syslog and rsyslog tags).</p>
-</body></html>
\ No newline at end of file
+</body></html>
diff --git a/doc/v3compatibility.html b/doc/v3compatibility.html
index c6e4fec..f4eef3a 100644
--- a/doc/v3compatibility.html
+++ b/doc/v3compatibility.html
@@ -3,7 +3,7 @@
 
 <meta name="KEYWORDS" content="syslog, mysql, syslog to mysql, howto"></head>
 <body>
-<h1>Compatibility Notes for rsyslog v4</h1>
+<h1>Compatibility Notes for rsyslog v3</h1>
 <p><small><i>Written by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a>
 (2008-03-28)</i></small></p>
 <p>Rsyslog aims to be a drop-in replacement for sysklogd.
@@ -193,4 +193,4 @@ format with care. </p><h2>Queue Modes for the Main Message Queue</h2>
 is available, but should not be used except for a very good reason
 ("Direct" disables queueing and will potentially lead to message loss
 on the input side).</p>
-</body></html>
\ No newline at end of file
+</body></html>
diff --git a/expr.c b/expr.c
index e6f4ef2..5c11b75 100644
--- a/expr.c
+++ b/expr.c
@@ -371,7 +371,6 @@ exprParse(expr_t *pThis, ctok_t *tok)
 	/* happy parsing... */
 	CHKiRet(expr(pThis, tok));
 	dbgoprint((obj_t*) pThis, "successfully parsed/created expression\n");
-vmprg.DebugPrint(pThis->pVmprg);
 
 finalize_it:
 	RETiRet;
@@ -392,8 +391,6 @@ CODESTARTobjQueryInterface(expr)
 	 * work here (if we can support an older interface version - that,
 	 * of course, also affects the "if" above).
 	 */
-	//xxxpIf->oID = OBJexpr;
-
 	pIf->Construct = exprConstruct;
 	pIf->ConstructFinalize = exprConstructFinalize;
 	pIf->Destruct = exprDestruct;
diff --git a/liblogging-stub.h b/liblogging-stub.h
index 03315f0..03315f0 100755..100644
--- a/liblogging-stub.h
+++ b/liblogging-stub.h
diff --git a/modules.c b/modules.c
index b6164f9..84f017e 100644
--- a/modules.c
+++ b/modules.c
@@ -554,26 +554,28 @@ Load(uchar *pModName)
 {
 	DEFiRet;
 	
-	size_t iPathLen;
+	size_t iPathLen, iModNameLen;
 	uchar szPath[PATH_MAX];
-	uchar *pModNameBase;
-	uchar *pModNameDup;
-	uchar *pExtension;
+	uchar *pModNameCmp;
+	int bHasExtension;
         void *pModHdlr, *pModInit;
 	modInfo_t *pModInfo;
 
 	assert(pModName != NULL);
 	dbgprintf("Requested to load module '%s'\n", pModName);
 
-	if((pModNameDup = (uchar *) strdup((char *) pModName)) == NULL)
-		ABORT_FINALIZE(RS_RET_OUT_OF_MEMORY);
+	iModNameLen = strlen((char *) pModName);
+	if(iModNameLen > 3 && !strcmp((char *) pModName + iModNameLen - 3, ".so")) {
+		iModNameLen -= 3;
+		bHasExtension = TRUE;
+	} else
+		bHasExtension = FALSE;
 
-	pModNameBase = (uchar *) basename((char*)pModNameDup);
 	pModInfo = GetNxt(NULL);
 	while(pModInfo != NULL) {
-		if(!strcmp((char *) pModNameBase, (char *) modGetName(pModInfo))) {
+		if(!strncmp((char *) pModName, (char *) (pModNameCmp = modGetName(pModInfo)), iModNameLen) &&
+		   (!*(pModNameCmp + iModNameLen) || !strcmp((char *) pModNameCmp + iModNameLen, ".so"))) {
 			dbgprintf("Module '%s' already loaded\n", pModName);
-			free(pModNameDup);
 			ABORT_FINALIZE(RS_RET_OK);
 		}
 		pModInfo = GetNxt(pModInfo);
@@ -593,7 +595,6 @@ Load(uchar *pModName)
 				szPath[iPathLen] = '\0';
 			} else {
 				errmsg.LogError(NO_ERRCODE, "could not load module '%s', path too long\n", pModName);
-				free(pModNameDup);
 				ABORT_FINALIZE(RS_RET_ERR);
 			}
 		}
@@ -603,10 +604,7 @@ Load(uchar *pModName)
 	strncat((char *) szPath, (char *) pModName, sizeof(szPath) - iPathLen - 1);
 
 	/* now see if we have an extension and, if not, append ".so" */
-	for(pExtension = pModNameBase ; *pExtension && *pExtension != '.' ; ++pExtension)
-		/*DO NOTHING*/;
-	
-	if(*pExtension != '.') {
+	if(!bHasExtension) {
 		/* we do not have an extension and so need to add ".so"
 		 * TODO: I guess this is highly importable, so we should change the
 		 * algo over time... -- rgerhards, 2008-03-05
@@ -615,7 +613,6 @@ Load(uchar *pModName)
 		strncat((char *) szPath, ".so", sizeof(szPath) - strlen((char*) szPath) - 1);
 		iPathLen += 3;
 	}
-	free(pModNameDup);
 
 	if(iPathLen + strlen((char*) pModName) >= sizeof(szPath)) {
 		errmsg.LogError(NO_ERRCODE, "could not load module '%s', path too long\n", pModName);
diff --git a/net.c b/net.c
index 0dbf3bf..ab66932 100644
--- a/net.c
+++ b/net.c
@@ -150,7 +150,6 @@ static rsRetVal AddAllowedSenderEntry(struct AllowedSenders **ppRoot, struct All
  */
 void clearAllowedSenders (struct AllowedSenders *pAllow)
 {
-dbgprintf("clearAllowedSenders(0x%lx)\n", (unsigned long) pAllow);
 	if (pAllow != NULL) {
 		if (pAllow->pNext != NULL)
 			clearAllowedSenders (pAllow->pNext);
@@ -860,7 +859,6 @@ void closeUDPListenSockets(int *pSockArr)
 {
 	register int i;
 
-dbgprintf("in closeUDPListenSockets()\n");
 	assert(pSockArr != NULL);
         if(pSockArr != NULL) {
 	        for (i = 0; i < *pSockArr; i++)
diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h
index 2db7500..71525a7 100644
--- a/plugins/imklog/imklog.h
+++ b/plugins/imklog/imklog.h
@@ -42,6 +42,5 @@ extern void vsyslog(int pri, const char *fmt, va_list ap);
 rsRetVal Syslog(int priority, char *fmt, ...) __attribute__((format(printf,2, 3)));
 
 #endif /* #ifndef IMKLOG_H_INCLUDED */
-/*
- * vi:set ai:
+/* vi:set ai:
  */
diff --git a/plugins/imklog/ksym.c b/plugins/imklog/ksym.c
index c9fd714..b7d5903 100644
--- a/plugins/imklog/ksym.c
+++ b/plugins/imklog/ksym.c
@@ -1,8 +1,9 @@
-/*
-    ksym.c - functions for kernel address->symbol translation
-    Copyright (c) 1995, 1996  Dr. G.W. Wettstein <greg@wind.rmcc.com>
-    Copyright (c) 1996 Enjellic Systems Development
-
+/*  ksym.c - functions for kernel address->symbol translation
+ *  Copyright (c) 1995, 1996  Dr. G.W. Wettstein <greg@wind.rmcc.com>
+ *  Copyright (c) 1996 Enjellic Systems Development
+ *  Copyright (c) 1998-2007 Martin Schulze <joey@infodrom.org>
+ *  Copyright (C) 2007-2008 Rainer Gerhards <rgerhards@adiscon.com>
+ *
  * This file is part of rsyslog.
  *
  * Rsyslog is free software: you can redistribute it and/or modify
@@ -120,16 +121,10 @@
 #include <syslog.h>
 #include "imklog.h"
 #include "ksyms.h"
+#include "module.h"
 
 
-/* Variables static to this module. */
-struct sym_table
-{
-	unsigned long value;
-	char *name;
-};
-
-static int num_syms = 0;
+int num_syms = 0;
 static int i_am_paranoid = 0;
 static char vstring[12];
 static struct sym_table *sym_array = (struct sym_table *) 0;
@@ -187,26 +182,20 @@ extern int InitKsyms(char *mapfile)
 	/*
 	 * Search for and open the file containing the kernel symbols.
 	 */
-	if ( mapfile != (char *) 0 )
-	{
+	if ( mapfile != (char *) 0 ) {
 		if ( (sym_file = fopen(mapfile, "r")) == (FILE *) 0 )
 		{
-			Syslog(LOG_WARNING, "Cannot open map file: %s.", \
-			       mapfile);
+			Syslog(LOG_WARNING, "Cannot open map file: %s.", mapfile);
 			return(0);
 		}
-	}
-	else
-	{
-		if ( (mapfile = FindSymbolFile()) == (char *) 0 ) 
-		{
+	} else {
+		if ( (mapfile = FindSymbolFile()) == (char *) 0 ) {
 			Syslog(LOG_WARNING, "Cannot find map file.");
 			dbgprintf("Cannot find map file.\n");
 			return(0);
 		}
 		
-		if ( (sym_file = fopen(mapfile, "r")) == (FILE *) 0 )
-		{
+		if ( (sym_file = fopen(mapfile, "r")) == (FILE *) 0 ) {
 			Syslog(LOG_WARNING, "Cannot open map file.");
 			dbgprintf("Cannot open map file.\n");
 			return(0);
@@ -222,11 +211,8 @@ extern int InitKsyms(char *mapfile)
 	 * e-mail me a diff containing a parser with suitable political
 	 * correctness -- GW.
 	 */
-	while ( !feof(sym_file) )
-	{
-		if ( fscanf(sym_file, "%lx %c %s\n", &address, &type, sym)
-		    != 3 )
-		{
+	while ( !feof(sym_file) ) {
+		if ( fscanf(sym_file, "%lx %c %s\n", &address, &type, sym) != 3 ) {
 			Syslog(LOG_ERR, "Error in symbol table input (#1).");
 			fclose(sym_file);
 			return(0);
@@ -234,8 +220,7 @@ extern int InitKsyms(char *mapfile)
 		if(dbgPrintSymbols)
 			dbgprintf("Address: %lx, Type: %c, Symbol: %s\n", address, type, sym);
 
-		if ( AddSymbol(address, sym) == 0 )
-		{
+		if ( AddSymbol(address, sym) == 0 ) {
 			Syslog(LOG_ERR, "Error adding symbol - %s.", sym);
 			fclose(sym_file);
 			return(0);
@@ -247,16 +232,14 @@ extern int InitKsyms(char *mapfile)
 	
 
 	Syslog(LOG_INFO, "Loaded %d symbols from %s.", num_syms, mapfile);
-	switch ( version )
-	{
+	switch(version) {
 	    case -1:
 		Syslog(LOG_WARNING, "Symbols do not match kernel version.");
 		num_syms = 0;
 		break;
 
 	    case 0:
-		Syslog(LOG_WARNING, "Cannot verify that symbols match " \
-		       "kernel version.");
+		Syslog(LOG_WARNING, "Cannot verify that symbols match kernel version.");
 		break;
 		
 	    case 1:
@@ -317,18 +300,16 @@ static char *FindSymbolFile(void)
 
 	auto FILE *sym_file = (FILE *) 0;
 
-        if ( uname(&utsname) < 0 )
-        {
+        if ( uname(&utsname) < 0 ) {
                 Syslog(LOG_ERR, "Cannot get kernel version information.");
                 return(0);
         }
 
 	dbgprintf("Searching for symbol map.\n");
 	
-	for (mf = system_maps; *mf != (char *) 0 && file == (char *) 0; ++mf)
-	{
+	for(mf = system_maps; *mf != (char *) 0 && file == (char *) 0; ++mf) {
  
-		sprintf (symfile, "%s-%s", *mf, utsname.release);
+		snprintf(symfile, sizeof(symfile), "%s-%s", *mf, utsname.release);
 		dbgprintf("Trying %s.\n", symfile);
 		if ( (sym_file = fopen(symfile, "r")) != (FILE *) 0 ) {
 			if (CheckMapVersion(symfile) == 1)
@@ -347,10 +328,7 @@ static char *FindSymbolFile(void)
 
 	}
 
-	/*
-	 * At this stage of the game we are at the end of the symbol
-	 * tables.
-	 */
+	/* At this stage of the game we are at the end of the symbol tables.  */
 	dbgprintf("End of search list encountered.\n");
 	return(file);
 }
@@ -413,8 +391,7 @@ static int CheckVersion(char *version)
 		return(0);
 
 
-	/*
-	 * Since the symbol looks like a kernel version we can start
+	/* Since the symbol looks like a kernel version we can start
 	 * things out by decoding the version string into its component
 	 * parts.
 	 */
@@ -426,24 +403,20 @@ static int CheckVersion(char *version)
 		  strlen(prefix), major, minor, patch);
 	sprintf(vstring, "%d.%d.%d", major, minor, patch);
 
-	/*
-	 * We should now have the version string in the vstring variable in
+	/* We should now have the version string in the vstring variable in
 	 * the same format that it is stored in by the kernel.  We now
 	 * ask the kernel for its version information and compare the two
 	 * values to determine if our system map matches the kernel
 	 * version level.
 	 */
-	if ( uname(&utsname) < 0 )
-	{
+	if ( uname(&utsname) < 0 ) {
 		Syslog(LOG_ERR, "Cannot get kernel version information.");
 		return(0);
 	}
 	dbgprintf("Comparing kernel %s with symbol table %s.\n", utsname.release, vstring);
 
-	if ( sscanf (utsname.release, "%d.%d.%d", &major, &minor, &patch) < 3 )
-	{
-		Syslog(LOG_ERR, "Kernel send bogus release string `%s'.",
-		       utsname.release);
+	if ( sscanf (utsname.release, "%d.%d.%d", &major, &minor, &patch) < 3 ) {
+		Syslog(LOG_ERR, "Kernel send bogus release string `%s'.", utsname.release);
 		return(0);
 	}
 
@@ -500,11 +473,8 @@ static int CheckMapVersion(char *fname)
 		Syslog(LOG_INFO, "Inspecting %s", fname);
 
 		version = 0;
-		while ( !feof(sym_file) && (version == 0) )
-		{
-			if ( fscanf(sym_file, "%lx %c %s\n", &address, \
-				    &type, sym) != 3 )
-			{
+		while ( !feof(sym_file) && (version == 0) ) {
+			if ( fscanf(sym_file, "%lx %c %s\n", &address, &type, sym) != 3 ) {
 				Syslog(LOG_ERR, "Error in symbol table input (#2).");
 				fclose(sym_file);
 				return(0);
@@ -515,11 +485,9 @@ static int CheckMapVersion(char *fname)
 		}
 		fclose(sym_file);
 
-		switch ( version )
-		{
+		switch ( version ) {
 		    case -1:
-			Syslog(LOG_ERR, "Symbol table has incorrect " \
-				"version number.\n");
+			Syslog(LOG_ERR, "Symbol table has incorrect version number.\n");
 			break;
 		    case 0:
 			dbgprintf("No version information found.\n");
@@ -552,14 +520,13 @@ static int CheckMapVersion(char *fname)
 static int AddSymbol(unsigned long address, char *symbol)
 {
 	/* Allocate the the symbol table entry. */
-	sym_array = (struct sym_table *) realloc(sym_array, (num_syms+1) * \
+	sym_array = (struct sym_table *) realloc(sym_array, (num_syms+1) *
 						 sizeof(struct sym_table));
 	if ( sym_array == (struct sym_table *) 0 )
 		return(0);
 
 	/* Then the space for the symbol. */
-	sym_array[num_syms].name = (char *) malloc(strlen(symbol)*sizeof(char)\
-						   + 1);
+	sym_array[num_syms].name = (char *) malloc(strlen(symbol)*sizeof(char) + 1);
 	if ( sym_array[num_syms].name == (char *) 0 )
 		return(0);
 	
@@ -591,37 +558,53 @@ static int AddSymbol(unsigned long address, char *symbol)
  **************************************************************************/
 char * LookupSymbol(unsigned long value, struct symbol *sym)
 {
-	auto int lp;
-	auto char *last;
+        auto int lp;
+
+        auto char *last;
+        auto char *name;
+
+        struct symbol ksym, msym;
+
+        if (!sym_array)
+                return((char *) 0);
+
+        last = sym_array[0].name;
+        ksym.offset = 0;
+        ksym.size = 0;
+        if ( value < sym_array[0].value )
+                return((char *) 0);
+
+        for(lp = 0; lp <= num_syms; ++lp) {
+                if ( sym_array[lp].value > value ) {
+                        ksym.offset = value - sym_array[lp-1].value;
+                        ksym.size = sym_array[lp].value - \
+                                sym_array[lp-1].value;
+                        break;
+                }
+                last = sym_array[lp].name;
+        }
 
-	if (!sym_array)
-		return((char *) 0);
+        name = LookupModuleSymbol(value, &msym);
 
-	last = sym_array[0].name;
-	sym->offset = 0;
-	sym->size = 0;
-	if ( value < sym_array[0].value )
-		return((char *) 0);
-	
-	for(lp= 0; lp <= num_syms; ++lp)
-	{
-		if ( sym_array[lp].value > value )
-		{		
-			sym->offset = value - sym_array[lp-1].value;
-			sym->size = sym_array[lp].value - \
-				sym_array[lp-1].value;
-			return(last);
-		}
-		last = sym_array[lp].name;
-	}
+        if ( ksym.offset == 0 && msym.offset == 0 ) {
+                return((char *) 0);
+        }
+
+        if ( ksym.offset == 0 || msym.offset < 0 ||
+             (ksym.offset > 0 && ksym.offset < msym.offset) ) {
+                sym->offset = ksym.offset;
+                sym->size = ksym.size;
+                return(last);
+        } else {
+                sym->offset = msym.offset;
+                sym->size = msym.size;
+                return(name);
+        }
 
-	if ( (last = LookupModuleSymbol(value, sym)) != (char *) 0 )
-		return(last);
 
-	return(NULL);
+        return((char *) 0);
 }
 
-
 /**************************************************************************
  * Function:	FreeSymbols
  *
@@ -679,6 +662,9 @@ extern char *ExpandKadds(char *line, char *el)
 	auto unsigned long int value;
 	auto struct symbol sym;
 
+        sym.offset = 0;
+        sym.size = 0;
+
 	/*
 	 * This is as handy a place to put this as anyplace.
 	 *
@@ -706,12 +692,10 @@ extern char *ExpandKadds(char *line, char *el)
 	 * messages in this line.
 	 */
 	if ( (num_syms == 0) ||
-	     (kp = strstr(line, "[<")) == (char *) 0 )
-	{
+	     (kp = strstr(line, "[<")) == (char *) 0 ) {
 #ifdef __sparc__
 		if (num_syms) {
-			/*
-			 * On SPARC, register dumps do not have the [< >] characters in it.
+			/* On SPARC, register dumps do not have the [< >] characters in it.
 			 */
 			static struct sparc_tests {
 				char *str;
@@ -791,14 +775,12 @@ extern char *ExpandKadds(char *line, char *el)
 	}
 
 	/* Loop through and expand all kernel messages. */
-	do
-	{
+	do {
 		while ( sl < kp+1 )
 			*elp++ = *sl++;
 
 		/* Now poised at a kernel delimiter. */
-	        if ( (kp = strstr(sl, ">]")) == (char *) 0 )
-		{
+	        if ( (kp = strstr(sl, ">]")) == (char *) 0 ) {
 			strcpy(el, sl);
 			return(el);
 		}
@@ -815,11 +797,10 @@ extern char *ExpandKadds(char *line, char *el)
 			  (sym.size==0) ? symbol+1 : symbol, sym.offset, sym.size);
 
 		value = 2;
-		if ( sym.size != 0 )
-		{
+		if ( sym.size != 0 ) {
 			--value;
 			++kp;
-			elp += sprintf(elp, "+%x/%d", sym.offset, sym.size);
+			elp += sprintf(elp, "+0x%x/0x%02x", sym.offset, sym.size);
 		}
 		strncat(elp, kp, value);
 		elp += value;
@@ -847,7 +828,6 @@ extern char *ExpandKadds(char *line, char *el)
  *				present when resolving kernel exceptions.
  * Return:	void
  **************************************************************************/
-
 extern void SetParanoiaLevel(int level)
 {
 	i_am_paranoid = level;
diff --git a/plugins/imklog/ksym_mod.c b/plugins/imklog/ksym_mod.c
index 3c7e0e4..11535a5 100644
--- a/plugins/imklog/ksym_mod.c
+++ b/plugins/imklog/ksym_mod.c
@@ -1,8 +1,10 @@
 /*
-    ksym_mod.c - functions for building symbol lookup tables for klogd
-    Copyright (c) 1995, 1996  Dr. G.W. Wettstein <greg@wind.rmcc.com>
-    Copyright (c) 1996 Enjellic Systems Development
-
+ *  ksym_mod.c - functions for building symbol lookup tables for klogd
+ *  Copyright (c) 1995, 1996  Dr. G.W. Wettstein <greg@wind.rmcc.com>
+ *  Copyright (c) 1996 Enjellic Systems Development
+ *  Copyright (c) 1998-2007 Martin Schulze <joey@infodrom.org>
+ *  Copyright (C) 2007-2008 Rainer Gerhards <rgerhards@adiscon.com>
+ *
  * This file is part of rsyslog.
  *
  * Rsyslog is free software: you can redistribute it and/or modify
@@ -86,6 +88,7 @@
 #include "config.h"
 #include <stdio.h>
 #include <stdlib.h>
+#include <ctype.h>
 #include <unistd.h>
 #include <signal.h>
 #include <string.h>
@@ -97,8 +100,6 @@
 #include <linux/module.h>
 #else /* __GLIBC__ */
 #include "module.h"
-extern __off64_t lseek64 __P ((int __fd, __off64_t __offset, int __whence));
-extern int get_kernel_syms __P ((struct kernel_sym *__table));
 #endif /* __GLIBC__ */
 #include <stdarg.h>
 #include <paths.h>
@@ -108,42 +109,7 @@ extern int get_kernel_syms __P ((struct kernel_sym *__table));
 #include "imklog.h"
 #include "ksyms.h"
 
-
-#if !defined(__GLIBC__)
-/*
- * The following bit uses some kernel/library magic to product what
- * looks like a function call to user level code.  This function is
- * actually a system call in disguise.  The purpose of the getsyms
- * call is to return a current copy of the in-kernel symbol table.
- */
-#define __LIBRARY__
-#include <linux/unistd.h>
-#define __NR_getsyms __NR_get_kernel_syms
-_syscall1(int, getsyms, struct kernel_sym *, syms);
-#undef __LIBRARY__
-extern int getsyms(struct kernel_sym *);
-#else /* __GLIBC__ */
-#define getsyms get_kernel_syms
-#endif /* __GLIBC__ */
-
-/* Variables static to this module. */
-struct sym_table
-{
-	unsigned long value;
-	char *name;
-};
-
-struct Module
-{
-	struct sym_table *sym_array;
-	int num_syms;
-
-	char *name;
-	struct module module;
-#if LINUX_VERSION_CODE >= 0x20112
-	struct module_info module_info;
-#endif
-};
+#define KSYMS  "/proc/kallsyms"
 
 static int num_modules = 0;
 struct Module *sym_array_modules = (struct Module *) 0;
@@ -153,10 +119,13 @@ static int have_modules = 0;
 
 /* Function prototypes. */
 static void FreeModules(void);
-static int AddSymbol(struct Module *mp, unsigned long, char *);
-static int AddModule(unsigned long, char *);
+static int AddSymbol(const char *);
+struct Module *AddModule(const char *);
 static int symsort(const void *, const void *);
 
+/* Imported from ksym.c */
+extern int num_syms;
+
 
 /**************************************************************************
  * Function:	InitMsyms
@@ -175,94 +144,70 @@ static int symsort(const void *, const void *);
  **************************************************************************/
 extern int InitMsyms(void)
 {
-	auto int	rtn,
-			tmp;
-
-	auto struct kernel_sym	*ksym_table,
-				*p;
 
+        auto int        rtn,
+                        tmp;
+        FILE *ksyms;
+        char buf[128];
+        char *p;
 
 	/* Initialize the kernel module symbol table. */
 	FreeModules();
 
+       ksyms = fopen(KSYMS, "r");
 
-	/*
-	 * The system call which returns the kernel symbol table has
-	 * essentialy two modes of operation.  Called with a null pointer
-	 * the system call returns the number of symbols defined in the
-	 * the table.
-	 *
-	 * The second mode of operation is to pass a valid pointer to
-	 * the call which will then load the current symbol table into
-	 * the memory provided.
-	 *
-	 * Returning the symbol table is essentially an all or nothing
-	 * proposition so we need to pre-allocate enough memory for the
-	 * complete table regardless of how many symbols we need.
-	 *
-	 * Bummer.
-	 */
-	if ( (rtn = getsyms((struct kernel_sym *) 0)) < 0 )
-	{
-		if ( errno == ENOSYS )
-			Syslog(LOG_INFO, "No module symbols loaded - "
-			       "kernel modules not enabled.\n");
-		else
-			Syslog(LOG_ERR, "Error loading kernel symbols " \
-			       "- %s\n", strerror(errno));
-		return(0);
-	}
-	dbgprintf("Loading kernel module symbols - Size of table: %d\n", rtn);
+        if ( ksyms == NULL ) {
+                if ( errno == ENOENT )
+                        Syslog(LOG_INFO, "No module symbols loaded - "
+                               "kernel modules not enabled.\n");
+                else
+                        Syslog(LOG_ERR, "Error loading kernel symbols " \
+                               "- %s\n", strerror(errno));
+                fclose(ksyms);
+                return(0);
+        }
 
-	ksym_table = (struct kernel_sym *) malloc(rtn * sizeof(struct kernel_sym));
-	if ( ksym_table == (struct kernel_sym *) 0 )
-	{
-		Syslog(LOG_WARNING, " Failed memory allocation for kernel symbol table.\n");
-		return(0);
-	}
-	if ( (rtn = getsyms(ksym_table)) < 0 )
-	{
-		Syslog(LOG_WARNING, "Error reading kernel symbols - %s\n", strerror(errno));
-		return(0);
-	}
-
-
-	/*
-	 * Build a symbol table compatible with the other one used by
-	 * klogd.
-	 */
-	tmp = rtn;
-	p = ksym_table;
-	while ( tmp-- )
-	{
- 		if ( !AddModule(p->value, p->name) )
-		{
-			Syslog(LOG_WARNING, "Error adding kernel module table entry.\n");
-			free(ksym_table);
-			return(0);
-		}
-		++p;
-	}
-
-	/* Sort the symbol tables in each module. */
-	for (rtn = tmp= 0; tmp < num_modules; ++tmp)
-	{
-		rtn += sym_array_modules[tmp].num_syms;
-		if ( sym_array_modules[tmp].num_syms < 2 )
-			continue;
-		qsort(sym_array_modules[tmp].sym_array, \
-		      sym_array_modules[tmp].num_syms, \
-		      sizeof(struct sym_table), symsort);
-	}
-
-	if ( rtn == 0 )
-		Syslog(LOG_INFO, "No module symbols loaded.");
-	else
-		Syslog(LOG_INFO, "Loaded %d %s from %d module%s", rtn, \
-		       (rtn == 1) ? "symbol" : "symbols", \
-		       num_modules, (num_modules == 1) ? "." : "s.");
-	free(ksym_table);
-	return(1);
+	dbgprintf("Loading kernel module symbols - Source: %s\n", KSYMS);
+
+        while ( fgets(buf, sizeof(buf), ksyms) != NULL ) {
+                if (num_syms > 0 && index(buf, '[') == NULL)
+                        continue;
+
+                p = index(buf, ' ');
+
+                if ( p == NULL )
+                        continue;
+
+                if ( buf[strlen(buf)-1] == '\n' )
+                        buf[strlen(buf)-1] = '\0';
+                /* overlong lines will be ignored above */
+
+                AddSymbol(buf);
+        }
+
+	if(ksyms != NULL)
+		fclose(ksyms);
+
+        have_modules = 1;
+
+        /* Sort the symbol tables in each module. */
+        for (rtn = tmp = 0; tmp < num_modules; ++tmp) {
+                rtn += sym_array_modules[tmp].num_syms;
+                if ( sym_array_modules[tmp].num_syms < 2 )
+                        continue;
+                qsort(sym_array_modules[tmp].sym_array, \
+                      sym_array_modules[tmp].num_syms, \
+                      sizeof(struct sym_table), symsort);
+        }
+
+        if ( rtn == 0 )
+                Syslog(LOG_INFO, "No module symbols loaded.");
+        else
+                Syslog(LOG_INFO, "Loaded %d %s from %d module%s", rtn, \
+                       (rtn == 1) ? "symbol" : "symbols", \
+                       num_modules, (num_modules == 1) ? "." : "s.");
+
+        return(1);
 }
 
 
@@ -295,134 +240,92 @@ extern void DeinitMsyms(void)
  *
  * Return:	void
  **************************************************************************/
-static void FreeModules(void)
+static void FreeModules()
 {
-	auto int	nmods,
-			nsyms;
-
-	auto struct Module *mp;
-
-
-	/* Check to see if the module symbol tables need to be cleared. */
-	have_modules = 0;
-	if ( num_modules == 0 )
-		return;
-
-
-	for (nmods= 0; nmods < num_modules; ++nmods)
-	{
-		mp = &sym_array_modules[nmods];
-		if ( mp->num_syms == 0 )
-			continue;
-	       
-		for (nsyms= 0; nsyms < mp->num_syms; ++nsyms)
-			free(mp->sym_array[nsyms].name);
-		free(mp->sym_array);
-	}
-
-	free(sym_array_modules);
-	sym_array_modules = (struct Module *) 0;
-	num_modules = 0;
-	return;
+        auto int        nmods,
+                        nsyms;
+        auto struct Module *mp;
+
+        /* Check to see if the module symbol tables need to be cleared. */
+        have_modules = 0;
+        if ( num_modules == 0 )
+                return;
+
+        if ( sym_array_modules == NULL )
+                return;
+
+        for (nmods = 0; nmods < num_modules; ++nmods) {
+                mp = &sym_array_modules[nmods];
+                if ( mp->num_syms == 0 )
+                        continue;
+
+                for (nsyms= 0; nsyms < mp->num_syms; ++nsyms)
+                        free(mp->sym_array[nsyms].name);
+                free(mp->sym_array);
+                if ( mp->name != NULL )
+                        free(mp->name);
+        }
+
+        free(sym_array_modules);
+        sym_array_modules = (struct Module *) 0;
+        num_modules = 0;
+        return;
 }
 
 
 /**************************************************************************
- * Function:	AddModule
- *
- * Purpose:	This function is responsible for adding a module to
- *		the list of currently loaded modules.
+ * Function:    AddModule
  *
- * Arguements:	(unsigned long) address, (char *) symbol
+ * Purpose:     This function is responsible for adding a module to
+ *              the list of currently loaded modules.
  *
- *		address:->	The address of the module.
+ * Arguments:   (const char *) module
  *
- *		symbol:->	The name of the module.
+ *              module:->       The name of the module.
  *
- * Return:	int
+ * Return:      struct Module *
  **************************************************************************/
-static int AddModule(unsigned long address, char *symbol)
-{
-	auto int memfd;
-	auto struct Module *mp;
-
-
-	/* Return if we have loaded the modules. */
-	if ( have_modules )
-		return(1);
-
-	/*
-	 * The following section of code is responsible for determining
-	 * whether or not we are done reading the list of modules.
-	 */
-	if ( symbol[0] == '#' )
-	{
-
-		if ( symbol[1] == '\0' )
-		{
-			/*
-			 * A symbol which consists of a # sign only
-			 * signifies a a resident kernel segment.  When we
-			 * hit one of these we are done reading the
-			 * module list.
-			 */
-			have_modules = 1;
-			return(1);
-		}
-		/* Allocate space for the module. */
-		sym_array_modules = (struct Module *) \
-			realloc(sym_array_modules, \
-				(num_modules+1) * sizeof(struct Module));
-		if ( sym_array_modules == (struct Module *) 0 )
-		{
-			Syslog(LOG_WARNING, "Cannot allocate Module array.\n");
-			return(0);
-		}
-		mp = &sym_array_modules[num_modules];
-
-		if ( (memfd = open("/dev/kmem", O_RDONLY)) < 0 )
-		{
-			Syslog(LOG_WARNING, "Error opening /dev/kmem\n");
-			return(0);
-		}
-		if ( lseek64(memfd, address, SEEK_SET) < 0 )
-		{
-			Syslog(LOG_WARNING, "Error seeking in /dev/kmem\n");
-			Syslog(LOG_WARNING, "Symbol %s, value %08lx\n", symbol, 
- 			       (unsigned long) address);
-			return(0);
-		}
-		if ( read(memfd, \
-			  (char *)&sym_array_modules[num_modules].module,  \
-			  sizeof(struct module)) < 0 )
-		{
-			Syslog(LOG_WARNING, "Error reading module "
-			       "descriptor.\n");
-			return(0);
-		}
-		close(memfd);
-
-		/* Save the module name. */
-		mp->name = (char *) malloc(strlen(&symbol[1]) + 1);
-		if ( mp->name == (char *) 0 )
-			return(0);
-		strcpy(mp->name, &symbol[1]);
-
-		mp->num_syms = 0;
-		mp->sym_array = (struct sym_table *) 0;
-		++num_modules;
-		return(1);
-	}
-	else
-	{
-	    if (num_modules > 0)
-		mp = &sym_array_modules[num_modules - 1];
-	    else
-		mp = &sym_array_modules[0];
-		AddSymbol(mp, address, symbol);
-	}
 
-	return(1);
+struct Module *AddModule(module)
+     const char *module;
+{
+        struct Module *mp;
+
+        if ( num_modules == 0 ) {
+                sym_array_modules = (struct Module *)malloc(sizeof(struct Module));
+
+                if ( sym_array_modules == NULL )
+                {
+                        Syslog(LOG_WARNING, "Cannot allocate Module array.\n");
+                        return NULL;
+                }
+                mp = sym_array_modules;
+        } else {
+                /* Allocate space for the module. */
+                mp = (struct Module *) \
+                        realloc(sym_array_modules, \
+                                (num_modules+1) * sizeof(struct Module));
+
+                if ( mp == NULL )
+                {
+                        Syslog(LOG_WARNING, "Cannot allocate Module array.\n");
+                        return NULL;
+                }
+
+                sym_array_modules = mp;
+                mp = &sym_array_modules[num_modules];
+        }
+
+        num_modules++;
+        mp->sym_array = NULL;
+        mp->num_syms = 0;
+
+        if ( module != NULL )
+                mp->name = strdup(module);
+        else
+                mp->name = NULL;
+
+        return mp;
 }
 
 
@@ -432,49 +335,78 @@ static int AddModule(unsigned long address, char *symbol)
  * Purpose:	This function is responsible for adding a symbol name
  *		and its address to the symbol table.
  *
- * Arguements:	(struct Module *) mp, (unsigned long) address, (char *) symbol
- *
- *		mp:->	A pointer to the module which the symbol is
- *			to be added to.
- *
- *		address:->	The address of the symbol.
- *
- *		symbol:->	The name of the symbol.
+ * Arguements:	const char *
  *
  * Return:	int
  *
  *		A boolean value is assumed.  True if the addition is
  *		successful.  False if not.
  **************************************************************************/
-static int AddSymbol(struct Module *mp, unsigned long address, char *symbol)
+static int AddSymbol(line)
+        const char *line;
 {
-	auto int tmp;
+        char *module;
+        unsigned long address;
+        char *p;
+        static char *lastmodule = NULL;
+        struct Module *mp;
 
-	/* Allocate space for the symbol table entry. */
-	mp->sym_array = (struct sym_table *) realloc(mp->sym_array, \
-        	(mp->num_syms+1) * sizeof(struct sym_table));
-	if ( mp->sym_array == (struct sym_table *) 0 )
-		return(0);
+        module = index(line, '[');
 
-	/* Then the space for the symbol. */
-	tmp = strlen(symbol);
-	tmp += (strlen(mp->name) + 1);
-	mp->sym_array[mp->num_syms].name = (char *) malloc(tmp + 1);
-	if ( mp->sym_array[mp->num_syms].name == (char *) 0 )
-		return(0);
-	memset(mp->sym_array[mp->num_syms].name, '\0', tmp + 1);
-	
-	/* Stuff interesting information into the module. */
-	mp->sym_array[mp->num_syms].value = address;
-	strcpy(mp->sym_array[mp->num_syms].name, mp->name);
-	strcat(mp->sym_array[mp->num_syms].name, ":");
-	strcat(mp->sym_array[mp->num_syms].name, symbol);
-	++mp->num_syms;
+        if ( module != NULL ) {
+                p = index(module, ']');
+                if ( p != NULL )
+                        *p = '\0';
+                p = module++;
+                while ( isspace(*(--p)) )
+			/*SKIP*/;
+                *(++p) = '\0';
+        }
 
-	return(1);
+        p = index(line, ' ');
+
+        if ( p == NULL )
+                return(0);
+
+        *p = '\0';
+
+        address  = strtoul(line, (char **) 0, 16);
+
+        p += 3;
+
+        if ( num_modules == 0 ||
+             ( lastmodule == NULL && module != NULL ) ||
+             ( module == NULL && lastmodule != NULL) ||
+             ( module != NULL && strcmp(module, lastmodule))) {
+                mp = AddModule(module);
+
+                if ( mp == NULL )
+                        return(0);
+        } else
+                mp = &sym_array_modules[num_modules-1];
+
+        lastmodule = mp->name;
+
+        /* Allocate space for the symbol table entry. */
+        mp->sym_array = (struct sym_table *) realloc(mp->sym_array, \
+                (mp->num_syms+1) * sizeof(struct sym_table));
+
+        if ( mp->sym_array == (struct sym_table *) 0 )
+                return(0);
+
+        mp->sym_array[mp->num_syms].name = strdup(p);
+        if ( mp->sym_array[mp->num_syms].name == (char *) 0 )
+                return(0);
+
+        /* Stuff interesting information into the module. */
+        mp->sym_array[mp->num_syms].value = address;
+        ++mp->num_syms;
+
+        return(1);
 }
 
 
+
 /**************************************************************************
  * Function:	LookupModuleSymbol
  *
@@ -494,103 +426,58 @@ static int AddSymbol(struct Module *mp, unsigned long address, char *symbol)
  *		If a match is found the pointer to the symbolic name most
  *		closely matching the address is returned.
  **************************************************************************/
-extern char * LookupModuleSymbol(unsigned long value, struct symbol *sym)
+extern char * LookupModuleSymbol(value, sym)
+        unsigned long value;
+        struct symbol *sym;
 {
-	auto int	nmod,
-			nsym;
-	auto struct sym_table *last;
-	auto struct Module *mp;
-
-
-	sym->size = 0;
-	sym->offset = 0;
-	if ( num_modules == 0 )
-		return((char *) 0);
-	
-	for(nmod= 0; nmod < num_modules; ++nmod)
-	{
-		mp = &sym_array_modules[nmod];
-
-		/*
+        auto int        nmod,
+                        nsym;
+        auto struct sym_table *last;
+        auto struct Module *mp;
+        static char ret[100];
+
+        sym->size = 0;
+        sym->offset = 0;
+        if ( num_modules == 0 )
+                return((char *) 0);
+
+        for (nmod = 0; nmod < num_modules; ++nmod) {
+                mp = &sym_array_modules[nmod];
+
+                /*
 		 * Run through the list of symbols in this module and
-		 * see if the address can be resolved.
-		 */
-		for(nsym= 1, last = &mp->sym_array[0];
-		    nsym < mp->num_syms;
-		    ++nsym)
-		{
-			if ( mp->sym_array[nsym].value > value )
-			{		
-				sym->offset = value - last->value;
-				sym->size = mp->sym_array[nsym].value - \
-					last->value;
-				return(last->name);
-			}
-			last = &mp->sym_array[nsym];
-		}
-
-		/*
-		 * At this stage of the game we still cannot give up the
-		 * ghost.  There is the possibility that the address is
-		 * from a module which has no symbols registered with
-		 * the kernel.  The solution is to compare the address
-		 * against the starting address and extant of the module
-		 * If it is in this range we can at least return the
-		 * name of the module.
+                 * see if the address can be resolved.
 		 */
-#if LINUX_VERSION_CODE < 0x20112
-		if ( (void *) value >= mp->module.addr &&
-		     (void *) value <= (mp->module.addr + \
-					mp->module.size * 4096) )
-#else
-		if ( value >= mp->module_info.addr &&
-		     value <= (mp->module_info.addr + \
-					mp->module.size * 4096) )
-#endif
-		{
-			/*
-			 * A special case needs to be checked for.  The above
-			 * conditional tells us that we are within the
-			 * extant of this module but symbol lookup has
-			 * failed.
-			 *
-			 * We need to check to see if any symbols have
-			 * been defined in this module.  If there have been
-			 * symbols defined the assumption must be made that
-			 * the faulting address lies somewhere beyond the
-			 * last symbol.  About the only thing we can do
-			 * at this point is use an offset from this
-			 * symbol.
-			 */
-			if ( mp->num_syms > 0 )
-			{
-				last = &mp->sym_array[mp->num_syms - 1];
-#if LINUX_VERSION_CODE < 0x20112
-				sym->size = (int) mp->module.addr + \
-					(mp->module.size * 4096) - value;
-#else
-				sym->size = (int) mp->module_info.addr + \
-					(mp->module.size * 4096) - value;
-#endif
-				sym->offset = value - last->value;
-				return(last->name);
-			}
-
-			/*
-			 * There were no symbols defined for this module.
-			 * Return the module name and the offset of the
-			 * faulting address in the module.
-			 */
-			sym->size = mp->module.size * 4096;
-#if LINUX_VERSION_CODE < 0x20112
-			sym->offset = (void *) value - mp->module.addr;
-#else
-			sym->offset = value - mp->module_info.addr;
-#endif
-			return(mp->name);
-		}
-	}
-
-	/* It has been a hopeless exercise. */
-	return(NULL);
+                for(nsym = 1, last = &mp->sym_array[0];
+                    nsym < mp->num_syms;
+                    ++nsym) {
+                        if ( mp->sym_array[nsym].value > value )
+                        {
+                           if ( sym->size == 0 ||
+                                 (value - last->value) < sym->offset ||
+                                 ( (sym->offset == (value - last->value)) &&
+                                   (mp->sym_array[nsym].value-last->value) < sym->size ) )
+                            {
+                                sym->offset = value - last->value;
+                                sym->size = mp->sym_array[nsym].value - \
+                                        last->value;
+                                ret[sizeof(ret)-1] = '\0';
+                                if ( mp->name == NULL )
+                                        snprintf(ret, sizeof(ret)-1,
+                                                 "%s", last->name);
+                                else
+                                        snprintf(ret, sizeof(ret)-1,
+                                                 "%s:%s", mp->name, last->name);
+                            }
+                            break;
+                        }
+                        last = &mp->sym_array[nsym];
+                }
+        }
+
+        if ( sym->size > 0 )
+                return(ret);
+
+        /* It has been a hopeless exercise. */
+        return((char *) 0);
 }
diff --git a/plugins/imklog/ksyms.h b/plugins/imklog/ksyms.h
index 316950a..b5362ff 100644
--- a/plugins/imklog/ksyms.h
+++ b/plugins/imklog/ksyms.h
@@ -1,10 +1,9 @@
-/*
-    ksym.h - Definitions for symbol table utilities.
-    Copyright (c) 1995, 1996  Dr. G.W. Wettstein <greg@wind.rmcc.com>
-    Copyright (c) 1996 Enjellic Systems Development
-
-    This file is part of the sysklogd package, a kernel and system log daemon.
-
+/*  ksym.h - Definitions for symbol table utilities.
+ *  Copyright (c) 1995, 1996  Dr. G.W. Wettstein <greg@wind.rmcc.com>
+ *  Copyright (c) 1996 Enjellic Systems Development
+ *  Copyright (c) 2004-7 Martin Schulze <joey@infodrom.org>
+ *  Copyright (c) 2007-2008 Rainer Gerhards <rgerhards@adiscon.com>
+ *
  * This file is part of rsyslog.
  *
  * Rsyslog is free software: you can redistribute it and/or modify
@@ -21,7 +20,7 @@
  * along with Rsyslog.  If not, see <http://www.gnu.org/licenses/>.
  *
  * A copy of the GPL can be found in the file "COPYING" in this distribution.
-*/
+ */
 
 /* Variables, structures and type definitions static to this module. */
 
diff --git a/plugins/imklog/module.h b/plugins/imklog/module.h
index 71eac2c..38a26fe 100644
--- a/plugins/imklog/module.h
+++ b/plugins/imklog/module.h
@@ -1,6 +1,7 @@
-/* Module definitions for klogd's module support 
- *
- * Copyright 2007 by Rainer Gerhards and others
+/*  module.h - Miscellaneous module definitions
+ *  Copyright (c) 1996 Richard Henderson <rth@tamu.edu>
+ *  Copyright (c) 2004-7 Martin Schulze <joey@infodrom.org>
+ *  Copyright (c) 2007-2008 Rainer Gerhards <rgerhards@adiscon.com>
  *
  * This file is part of rsyslog.
  *
@@ -19,63 +20,16 @@
  *
  * A copy of the GPL can be found in the file "COPYING" in this distribution.
  */
-struct kernel_sym
-{
-	        unsigned long value;
-	        char name[60];
-};
-
-struct module_symbol
+struct sym_table
 {
-	unsigned long value;
-	const char *name;
+        unsigned long value;
+        char *name;
 };
 
-struct module_ref
+struct Module
 {
-	struct module *dep;     /* "parent" pointer */
-	struct module *ref;     /* "child" pointer */
-	struct module_ref *next_ref;
-};
+        struct sym_table *sym_array;
+        int num_syms;
 
-struct module_info
-{
-	unsigned long addr;
-	unsigned long size;
-	unsigned long flags;
-	long usecount;
-};
-
-
-typedef struct { volatile int counter; } atomic_t;
-
-struct module
-{
-	unsigned long size_of_struct;   /* == sizeof(module) */
-	struct module *next;
-	const char *name;
-	unsigned long size;
-	
-	union
-	{
-		atomic_t usecount;
-		long pad;
-        } uc;                           /* Needs to keep its size - so says rth */
-	
-	unsigned long flags;            /* AUTOCLEAN et al */
-	
-	unsigned nsyms;
-	unsigned ndeps;
-	
-	struct module_symbol *syms;
-	struct module_ref *deps;
-	struct module_ref *refs;
-	int (*init)(void);
-	void (*cleanup)(void);
-	const struct exception_table_entry *ex_table_start;
-	const struct exception_table_entry *ex_table_end;
-#ifdef __alpha__
-	unsigned long gp;
-#endif
+        char *name;
 };
-	
diff --git a/plugins/omsnmp/omsnmp.c b/plugins/omsnmp/omsnmp.c
index 47afe2f..1deb9d6 100644
--- a/plugins/omsnmp/omsnmp.c
+++ b/plugins/omsnmp/omsnmp.c
@@ -489,6 +489,9 @@ CODESTARTmodExit
 		free(pszSnmpTrapOID);
 	if (pszSyslogMessageOID != NULL)
 		free(pszSyslogMessageOID);
+
+	/* release what we no longer need */
+	objRelease(errmsg, CORE_COMPONENT);
 ENDmodExit
 
 
diff --git a/srUtils.c b/srUtils.c
index fa451b7..fa451b7 100755..100644
--- a/srUtils.c
+++ b/srUtils.c
diff --git a/srUtils.h b/srUtils.h
index ebd6518..ebd6518 100755..100644
--- a/srUtils.h
+++ b/srUtils.h
diff --git a/stringbuf.c b/stringbuf.c
index 4254d5b..4254d5b 100755..100644
--- a/stringbuf.c
+++ b/stringbuf.c
diff --git a/stringbuf.h b/stringbuf.h
index aa31884..aa31884 100755..100644
--- a/stringbuf.h
+++ b/stringbuf.h
diff --git a/syslogd.c b/syslogd.c
index 355689c..4265bd4 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -1053,10 +1053,11 @@ static rsRetVal shouldProcessThisMessage(selector_t *f, msg_t *pMsg, int *bProce
 
 finalize_it:
 	/* destruct in any case, not just on error, but it makes error handling much easier */
-	if(pVM != NULL) {
-		var.Destruct(&pResult);
+	if(pVM != NULL)
 		vm.Destruct(&pVM);
-	}
+
+	if(pResult != NULL)
+		var.Destruct(&pResult);
 
 	*bProcessMsg = bRet;
 	RETiRet;
@@ -1740,6 +1741,7 @@ void legacyOptsHook(void)
 
 	while(pThis != NULL) {
 		if(pThis->line != NULL) {
+			errno = 0;
 			errmsg.LogError(NO_ERRCODE, "Warning: backward compatibility layer added to following "
 				        "directive to rsyslog.conf: %s", pThis->line);
 			conf.cfsysline(pThis->line);
@@ -2837,12 +2839,11 @@ InitGlobalClasses(void)
 	/* the following classes were intialized by objClassInit() */
 	CHKiRet(objUse(errmsg,   CORE_COMPONENT));
 	CHKiRet(objUse(module,   CORE_COMPONENT));
+	CHKiRet(objUse(var,      CORE_COMPONENT));
 
 	/* initialize and use classes. We must be very careful with the order of events. Some
 	 * classes use others and if we do not initialize them in the right order, we may end
 	 * up with an invalid call. The most important thing that can happen is that an error
-	pErrObj = "var";
-	CHKiRet(objUse(var,      CORE_COMPONENT));
 	 * is detected and needs to be logged, wich in turn requires a broader number of classes
 	 * to be available. The solution is that we take care in the order of calls AND use a
 	 * class immediately after it is initialized. And, of course, we load those classes
@@ -2899,6 +2900,7 @@ GlobalClassExit(void)
 	objRelease(conf,     CORE_COMPONENT);
 	objRelease(expr,     CORE_COMPONENT);
 	objRelease(vm,       CORE_COMPONENT);
+	objRelease(var,      CORE_COMPONENT);
 	objRelease(datetime, CORE_COMPONENT);
 
 	/* TODO: implement the rest of the deinit */
@@ -2924,10 +2926,7 @@ GlobalClassExit(void)
 	CHKiRet(templateInit());
 #endif
 	/* dummy "classes */
-dbgprintf("pre strExit()\n");
 	strExit();
-dbgprintf("post strExit()\n");
-
 
 #if 0
 	CHKiRet(objGetObjInterface(&obj)); /* this provides the root pointer for all other queries */
@@ -3024,7 +3023,7 @@ int realMain(int argc, char **argv)
 
 	/* END core initializations */
 
-	while ((ch = getopt(argc, argv, "46Ac:dehi:f:g:l:m:M:nqQr::s:t:u:vwx")) != EOF) {
+	while ((ch = getopt(argc, argv, "46aAc:def:g:hi:l:m:M:nopqQr::s:t:u:vwx")) != EOF) {
 		switch((char)ch) {
                 case '4':
 	                family = PF_INET;
@@ -3111,7 +3110,7 @@ int realMain(int argc, char **argv)
 					legacyOptsEnq((uchar *) "ModLoad imuxsock");
 					bImUxSockLoaded = 1;
 				}
-				legacyOptsEnq((uchar *) "OmitLocaLogging");
+				legacyOptsEnq((uchar *) "OmitLocalLogging");
 			} else {
 				fprintf(stderr, "error -o is no longer supported, use module imuxsock instead");
 			}
diff --git a/vm.c b/vm.c
index a26e433..b97898c 100644
--- a/vm.c
+++ b/vm.c
@@ -193,8 +193,6 @@ CODESTARTop(CMP_CONTAINS)
 	/* operand2 is on top of stack, so needs to be popped first */
 	vmstk.PopString(pThis->pStk, &operand2);
 	vmstk.PopString(pThis->pStk, &operand1);
-var.DebugPrint(operand1); \
-var.DebugPrint(operand2); \
 	/* TODO: extend cstr class so that it supports location of cstr inside cstr */
 	bRes = (rsCStrLocateInSzStr(operand2->val.pStr, rsCStrGetSzStr(operand1->val.pStr)) == -1) ? 0 : 1;
 
@@ -233,8 +231,6 @@ CODESTARTop(CMP_STARTSWITH)
 	/* operand2 is on top of stack, so needs to be popped first */
 	vmstk.PopString(pThis->pStk, &operand2);
 	vmstk.PopString(pThis->pStk, &operand1);
-var.DebugPrint(operand1); \
-var.DebugPrint(operand2); \
 	/* TODO: extend cstr class so that it supports location of cstr inside cstr */
 	bRes = (rsCStrStartsWithSzStr(operand1->val.pStr, rsCStrGetSzStr(operand2->val.pStr),
 		rsCStrLen(operand2->val.pStr)) == 0) ? 1 : 0;
@@ -254,14 +250,11 @@ CODESTARTop(CMP_STARTSWITHI)
 	/* operand2 is on top of stack, so needs to be popped first */
 	vmstk.PopString(pThis->pStk, &operand2);
 	vmstk.PopString(pThis->pStk, &operand1);
-var.DebugPrint(operand1); \
-var.DebugPrint(operand2); \
 	/* TODO: extend cstr class so that it supports location of cstr inside cstr */
 	bRes = (rsCStrCaseInsensitveStartsWithSzStr(operand1->val.pStr, rsCStrGetSzStr(operand2->val.pStr),
 		rsCStrLen(operand2->val.pStr)) == 0) ? 1 : 0;
 
 	/* we have a result, so let's push it */
-RUNLOG_VAR("%lld", bRes); \
 	PUSHRESULTop(operand1, bRes);
 	var.Destruct(&operand2); /* no longer needed */
 ENDop(CMP_STARTSWITHI)