You guess right ;)
I'm running latest Rsyslog 5.6.2. I pretty much came to the same
conclusions as you.
I doubt I can reproduce it. Out of several gigabytes of logs each day,
this is the first time I've seen it.
BR
Anders Synstad
Basefarm AS
On 01/20/2011 10:26 AM, Rainer Gerhards wrote:
Puuh, that's (very) hard to guess. Obviously it could be some program bug in
the receiver, but it could also be a problem at the sender side. Do you run
the latest builds of rsyslog? IF the problem is reproducible, a network trace
or debug log would be useful, but I guess I am not telling you anything new
;)
Rainer
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Anders Synstad
Sent: Thursday, January 20, 2011 10:08 AM
To: [email protected]
Subject: [rsyslog] Problem with "corrupt" log message
Hi,
I just noticed the following in my logfile:
2011-01-19T15:21:43.246003+01:00 HOSTA2011-01-19T15:21:43.247517+01:00
HOSTB<164>Jan 19 2011 15:21:43: RAWMESSAGE
It seems like the log message from 2 hosts has been merged in the
middle
of the first logmessage.
The relevant configuration looks like:
#
# Load modules
#
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by
rklogd)
$ModLoad imudp # Standard input module for UDP
$ModLoad imtcp # Standard input module for TCP
#
# Logfile templates
#
$template t-network,"/var/log/network.%$myhostname%.log"
$template bf-default,"%timegenerated:::date-rfc3339% %fromhost%
%rawmsg:::drop-last-lf%\n"
# Ruleset: network
$Ruleset network-udp-10514
$RulesetCreateMainQueue on
*.* -?t-network;bf-default
$RuleSet network-tcp-10514
$RulesetCreateMainQueue on
*.* -?t-network;bf-default
Any ideas what would cause the log message to be corrupted like that?
Regards,
Anders Synstad
Basefarm AS
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
