> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Anders Synstad > Sent: Thursday, January 20, 2011 11:54 AM > To: [email protected] > Subject: Re: [rsyslog] Problem with "corrupt" log message > > You guess right ;) > > I'm running latest Rsyslog 5.6.2. I pretty much came to the same > conclusions as you. > > I doubt I can reproduce it. Out of several gigabytes of logs each day, > this is the first time I've seen it.
Yup... Maybe this helps: I got some reports from folks who have a bit of a problem with 5.6.2 and a very good report came in yesterday. I am about to look at it. It could be that all of this has a common reason. But other than that, I do not have any advise right now... RAiner > > > BR > Anders Synstad > Basefarm AS > > On 01/20/2011 10:26 AM, Rainer Gerhards wrote: > > Puuh, that's (very) hard to guess. Obviously it could be some program > bug in > > the receiver, but it could also be a problem at the sender side. Do > you run > > the latest builds of rsyslog? IF the problem is reproducible, a > network trace > > or debug log would be useful, but I guess I am not telling you > anything new > > ;) > > > > Rainer > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Anders Synstad > >> Sent: Thursday, January 20, 2011 10:08 AM > >> To: [email protected] > >> Subject: [rsyslog] Problem with "corrupt" log message > >> > >> Hi, > >> > >> I just noticed the following in my logfile: > >> > >> 2011-01-19T15:21:43.246003+01:00 HOSTA2011-01- > 19T15:21:43.247517+01:00 > >> HOSTB<164>Jan 19 2011 15:21:43: RAWMESSAGE > >> > >> > >> It seems like the log message from 2 hosts has been merged in the > >> middle > >> of the first logmessage. > >> > >> The relevant configuration looks like: > >> # > >> # Load modules > >> # > >> $ModLoad imuxsock # provides support for local system logging > >> $ModLoad imklog # provides kernel logging support (previously done > by > >> rklogd) > >> $ModLoad imudp # Standard input module for UDP > >> $ModLoad imtcp # Standard input module for TCP > >> > >> # > >> # Logfile templates > >> # > >> $template t-network,"/var/log/network.%$myhostname%.log" > >> $template bf-default,"%timegenerated:::date-rfc3339% %fromhost% > >> %rawmsg:::drop-last-lf%\n" > >> > >> # Ruleset: network > >> $Ruleset network-udp-10514 > >> $RulesetCreateMainQueue on > >> *.* -?t-network;bf-default > >> > >> $RuleSet network-tcp-10514 > >> $RulesetCreateMainQueue on > >> *.* -?t-network;bf-default > >> > >> > >> Any ideas what would cause the log message to be corrupted like > that? > >> > >> > >> > >> Regards, > >> Anders Synstad > >> Basefarm AS > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
