Hi,
I just noticed the following in my logfile:
2011-01-19T15:21:43.246003+01:00 HOSTA2011-01-19T15:21:43.247517+01:00
HOSTB <164>Jan 19 2011 15:21:43: RAWMESSAGE
It seems like the log message from 2 hosts has been merged in the middle
of the first logmessage.
The relevant configuration looks like:
#
# Load modules
#
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by
rklogd)
$ModLoad imudp # Standard input module for UDP
$ModLoad imtcp # Standard input module for TCP
#
# Logfile templates
#
$template t-network,"/var/log/network.%$myhostname%.log"
$template bf-default,"%timegenerated:::date-rfc3339% %fromhost%
%rawmsg:::drop-last-lf%\n"
# Ruleset: network
$Ruleset network-udp-10514
$RulesetCreateMainQueue on
*.* -?t-network;bf-default
$RuleSet network-tcp-10514
$RulesetCreateMainQueue on
*.* -?t-network;bf-default
Any ideas what would cause the log message to be corrupted like that?
Regards,
Anders Synstad
Basefarm AS
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
