I have seen this on some older (6 month or so) builds, but only when there
are multiple selectors that write to the same file (the same selectors
send the logs further upstream, and the upstream logs are clean)
I know there have been a lot of improvements in this area, so I was
planning to upgrade before reporting it
David Lang
On Thu, 20 Jan 2011, Rainer
Gerhards wrote:
Date: Thu, 20 Jan 2011 10:26:15 +0100
From: Rainer Gerhards <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Problem with "corrupt" log message
Puuh, that's (very) hard to guess. Obviously it could be some program bug in
the receiver, but it could also be a problem at the sender side. Do you run
the latest builds of rsyslog? IF the problem is reproducible, a network trace
or debug log would be useful, but I guess I am not telling you anything new
;)
Rainer
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Anders Synstad
Sent: Thursday, January 20, 2011 10:08 AM
To: [email protected]
Subject: [rsyslog] Problem with "corrupt" log message
Hi,
I just noticed the following in my logfile:
2011-01-19T15:21:43.246003+01:00 HOSTA2011-01-19T15:21:43.247517+01:00
HOSTB <164>Jan 19 2011 15:21:43: RAWMESSAGE
It seems like the log message from 2 hosts has been merged in the
middle
of the first logmessage.
The relevant configuration looks like:
#
# Load modules
#
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by
rklogd)
$ModLoad imudp # Standard input module for UDP
$ModLoad imtcp # Standard input module for TCP
#
# Logfile templates
#
$template t-network,"/var/log/network.%$myhostname%.log"
$template bf-default,"%timegenerated:::date-rfc3339% %fromhost%
%rawmsg:::drop-last-lf%\n"
# Ruleset: network
$Ruleset network-udp-10514
$RulesetCreateMainQueue on
*.* -?t-network;bf-default
$RuleSet network-tcp-10514
$RulesetCreateMainQueue on
*.* -?t-network;bf-default
Any ideas what would cause the log message to be corrupted like that?
Regards,
Anders Synstad
Basefarm AS
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
