Multi-line messages are not supported by legacy plain syslogd. But you can
turn on the (o) option, which enables octect-counted framing, with which it
works. However, non-rsyslog receivers probably do not understand that
framing.
Rainer
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Kaiwang Chen
Sent: Wednesday, June 08, 2011 3:16 PM
To: rsyslog-users
Subject: [rsyslog] Problem with forwarded multiline message
Hello,
I set up two hosts to test rsyslogd, dns1 as client, z6 as server, and
found that
the server interpreted a copy of forwarded multiline message(3rd entry in
the following raw messages) into multiple entries(3rd and 4th entry in
actual
output), while locally generated multiline message was fine. What's the
problem?
The client setting:
$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format
*.* @@10.3.254.106:514
The server setting:
$InputPTCPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format $template
rawfmt,"%rawmsg%\n"
*.* /var/log/rawmessages;rawfmt
*.info;mail.none;authpriv.none;cron.none /var/log/messages
Other settings were action queue tuning, I guess they were irrelevant.
The raw messages:
<6>Jun 8 20:52:48 dns1 kernel: imklog 5.8.1, log source = /proc/kmsg
started.
<46>Jun 8 20:52:48 dns1 rsyslogd: [origin software="rsyslogd"
swVersion="5.8.1" x-pid="4152" x-info="http://www.rsyslog.com";] start
<43>Jun 8 20:52:48 dns1 rsyslogd-2066: could not load module
'/usr/lib64/rsyslog/omhdfs.so', dlopen: /usr/lib64/rsyslog/omhdfs.so:
cannot open shared object file: No such file or directory [try
http://www.rsyslog.com/e/2066 ] <43>Jun 8 20:52:48 dns1 rsyslogd: the last
error occured in /etc/rsyslog.conf, line 6:"$ModLoad omhdfs"
<43>Jun 8 20:52:48 dns1 rsyslogd-2124: CONFIG ERROR: could not interpret
master config file '/etc/rsyslog.conf'. [try
http://www.rsyslog.com/e/2124 ]
imklog 5.8.1, log source = /proc/kmsg started.
[origin software="rsyslogd" swVersion="5.8.1" x-pid="11033"
x-info="http://www.rsyslog.com";] start
could not load module '/usr/lib64/rsyslog/omhdfs.so', dlopen:
/usr/lib64/rsyslog/omhdfs.so: cannot open shared object file: No such file
or
directory [try http://www.rsyslog.com/e/2066 ] the last error occured in
/etc/rsyslog.conf, line 3:"$ModLoad omhdfs"
CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'.
[try
http://www.rsyslog.com/e/2124 ]
Actual ouput:
<6>1 2011-06-08T20:52:48+08:00 dns1 kernel - - - imklog 5.8.1, log source
=
/proc/kmsg started.
<46>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd - - - [origin
software="rsyslogd" swVersion="5.8.1" x-pid="4152"
x-info="http://www.rsyslog.com";] start
<43>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd-2066 - - - could not load
module '/usr/lib64/rsyslog/omhdfs.so', dlopen:
/usr/lib64/rsyslog/omhdfs.so: cannot open shared object file: No such file
or
directory
<13>1 2011-06-08T20:52:48.251337+08:00 bogon - - - [try
http://www.rsyslog.com/e/2066 ]
<43>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd - - - the last error occured
in
/etc/rsyslog.conf, line 6:"$ModLoad omhdfs"
<43>1 2011-06-08T20:52:48+08:00 dns1 rsyslogd-2124 - - - CONFIG
ERROR: could not interpret master config file '/etc/rsyslog.conf'.
[try http://www.rsyslog.com/e/2124 ]
<6>1 2011-06-08T20:59:33.791626+08:00 z6 kernel - - - imklog 5.8.1, log
source
= /proc/kmsg started.
<46>1 2011-06-08T20:59:33.791820+08:00 z6 rsyslogd - - - [origin
software="rsyslogd" swVersion="5.8.1" x-pid="11033"
x-info="http://www.rsyslog.com";] start
<43>1 2011-06-08T20:59:33.787162+08:00 z6 rsyslogd-2066 - - - could not
load
module '/usr/lib64/rsyslog/omhdfs.so', dlopen:
/usr/lib64/rsyslog/omhdfs.so: cannot open shared object file: No such file
or
directory [try http://www.rsyslog.com/e/2066 ]
<43>1 2011-06-08T20:59:33.787221+08:00 z6 rsyslogd - - - the last error
occured in /etc/rsyslog.conf, line 3:"$ModLoad omhdfs"
<43>1 2011-06-08T20:59:33.791571+08:00 z6 rsyslogd-2124 - - - CONFIG
ERROR: could not interpret master config file '/etc/rsyslog.conf'.
[try http://www.rsyslog.com/e/2124 ]
Thanks,
Kaiwang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
