Puuh, that's (very) hard to guess. Obviously it could be some program bug in the receiver, but it could also be a problem at the sender side. Do you run the latest builds of rsyslog? IF the problem is reproducible, a network trace or debug log would be useful, but I guess I am not telling you anything new ;)
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Anders Synstad > Sent: Thursday, January 20, 2011 10:08 AM > To: [email protected] > Subject: [rsyslog] Problem with "corrupt" log message > > Hi, > > I just noticed the following in my logfile: > > 2011-01-19T15:21:43.246003+01:00 HOSTA2011-01-19T15:21:43.247517+01:00 > HOSTB <164>Jan 19 2011 15:21:43: RAWMESSAGE > > > It seems like the log message from 2 hosts has been merged in the > middle > of the first logmessage. > > The relevant configuration looks like: > # > # Load modules > # > $ModLoad imuxsock # provides support for local system logging > $ModLoad imklog # provides kernel logging support (previously done by > rklogd) > $ModLoad imudp # Standard input module for UDP > $ModLoad imtcp # Standard input module for TCP > > # > # Logfile templates > # > $template t-network,"/var/log/network.%$myhostname%.log" > $template bf-default,"%timegenerated:::date-rfc3339% %fromhost% > %rawmsg:::drop-last-lf%\n" > > # Ruleset: network > $Ruleset network-udp-10514 > $RulesetCreateMainQueue on > *.* -?t-network;bf-default > > $RuleSet network-tcp-10514 > $RulesetCreateMainQueue on > *.* -?t-network;bf-default > > > Any ideas what would cause the log message to be corrupted like that? > > > > Regards, > Anders Synstad > Basefarm AS > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
