Multi-line messages are not supported by legacy plain syslogd. But you can turn on the (o) option, which enables octect-counted framing, with which it works. However, non-rsyslog receivers probably do not understand that framing. Rainer
> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Kaiwang Chen > Sent: Wednesday, June 08, 2011 3:16 PM > To: rsyslog-users > Subject: [rsyslog] Problem with forwarded multiline message > > Hello, > > I set up two hosts to test rsyslogd, dns1 as client, z6 as server, and found that > the server interpreted a copy of forwarded multiline message(3rd entry in > the following raw messages) into multiple entries(3rd and 4th entry in actual > output), while locally generated multiline message was fine. What's the > problem? > > The client setting: > $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format > *.* @@10.3.254.106:514 > > The server setting: > $InputPTCPServerRun 514 > $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format $template > rawfmt,"%rawmsg%\n" > *.* /var/log/rawmessages;rawfmt > *.info;mail.none;authpriv.none;cron.none /var/log/messages > > Other settings were action queue tuning, I guess they were irrelevant. > > The raw messages: > <6>Jun 8 20:52:48 dns1 kernel: imklog 5.8.1, log source = /proc/kmsg started. > <46>Jun 8 20:52:48 dns1 rsyslogd: [origin software="rsyslogd" > swVersion="5.8.1" x-pid="4152" x-info="http://www.rsyslog.com";] start > <43>Jun 8 20:52:48 dns1 rsyslogd-2066: could not load module > '/usr/lib64/rsyslog/omhdfs.so', dlopen: /usr/lib64/rsyslog/omhdfs.so: > cannot open shared object file: No such file or directory [try > http://www.rsyslog.com/e/2066 ] <43>Jun 8 20:52:48 dns1 rsyslogd: the last > error occured in /etc/rsyslog.conf, line 6:"$ModLoad omhdfs" > <43>Jun 8 20:52:48 dns1 rsyslogd-2124: CONFIG ERROR: could not interpret > master config file '/etc/rsyslog.conf'. [try > http://www.rsyslog.com/e/2124 ] > imklog 5.8.1, log source = /proc/kmsg started. > [origin software="rsyslogd" swVersion="5.8.1" x-pid="11033" > x-info="http://www.rsyslog.com";] start > could not load module '/usr/lib64/rsyslog/omhdfs.so', dlopen: > /usr/lib64/rsyslog/omhdfs.so: cannot open shared object file: No such file or > directory [try http://www.rsyslog.com/e/2066 ] the last error occured in > /etc/rsyslog.conf, line 3:"$ModLoad omhdfs" > CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try > http://www.rsyslog.com/e/2124 ] > > Actual ouput: > <6>1 2011-06-08T20:52:48+08:00 dns1 kernel - - - imklog 5.8.1, log source = > /proc/kmsg started. > <46>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd - - - [origin > software="rsyslogd" swVersion="5.8.1" x-pid="4152" > x-info="http://www.rsyslog.com";] start > <43>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd-2066 - - - could not load > module '/usr/lib64/rsyslog/omhdfs.so', dlopen: > /usr/lib64/rsyslog/omhdfs.so: cannot open shared object file: No such file or > directory > <13>1 2011-06-08T20:52:48.251337+08:00 bogon - - - [try > http://www.rsyslog.com/e/2066 ] > <43>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd - - - the last error occured in > /etc/rsyslog.conf, line 6:"$ModLoad omhdfs" > <43>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd-2124 - - - CONFIG > ERROR: could not interpret master config file '/etc/rsyslog.conf'. > [try http://www.rsyslog.com/e/2124 ] > <6>1 2011-06-08T20:59:33.791626+08:00 z6 kernel - - - imklog 5.8.1, log source > = /proc/kmsg started. > <46>1 2011-06-08T20:59:33.791820+08:00 z6 rsyslogd - - - [origin > software="rsyslogd" swVersion="5.8.1" x-pid="11033" > x-info="http://www.rsyslog.com";] start > <43>1 2011-06-08T20:59:33.787162+08:00 z6 rsyslogd-2066 - - - could not load > module '/usr/lib64/rsyslog/omhdfs.so', dlopen: > /usr/lib64/rsyslog/omhdfs.so: cannot open shared object file: No such file or > directory [try http://www.rsyslog.com/e/2066 ] > <43>1 2011-06-08T20:59:33.787221+08:00 z6 rsyslogd - - - the last error > occured in /etc/rsyslog.conf, line 3:"$ModLoad omhdfs" > <43>1 2011-06-08T20:59:33.791571+08:00 z6 rsyslogd-2124 - - - CONFIG > ERROR: could not interpret master config file '/etc/rsyslog.conf'. > [try http://www.rsyslog.com/e/2124 ] > > > Thanks, > Kaiwang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
