Comment 1 for bug 1634753

Is _only_ srcname being corrupted?

Back In The Day it was common for the kernel ring buffer for messages to overflow and overwrite messages, but of course it did not care what was being overwritten.

The kernel ring buffer is larger now, so it should be less common, but not impossible if the logging device is too slow to keep up with the rate of message generation.

If log messages must be kept intact, perhaps auditd makes more sense.

Or is something else going on?

Thanks