Hello, I'm trying to confirm if there's something wrong with my configuration, or if I may be running into a bug. I'm using rsyslog 5.8.1 and running into an issue with some log messages (seemingly randomly) being written to the wrong files.
On my client machines I forward messages for a number of applications whose names all begin with "app_" to a remote server using TCP and TLS. Here's the relevant part of my client config: $template Custom_ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %FROMHOST% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%" $ActionQueueType LinkedList $ActionQueueFileName forward $ActionResumeRetryCount -1 $ActionQueueSaveOnShutdown on if $programname startswith 'app_' then @@10.0.0.1:10514;Custom_ForwardFormat And on the server I send these to separate files based on the value of %PROGRAMNAME%: $template Custom_TraditionalFileFormat,"%TIMESTAMP% %FROMHOST% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $template production-file,"/var/log/company/production/%PROGRAMNAME%.log" $template production-errors-file,"/var/log/company/production/%PROGRAMNAME%-errors.log" $RuleSet production $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName production # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down $RulesetCreateMainQueue on # create ruleset-specific queue *.* ?production-file;Custom_TraditionalFileFormat *.err ?production-errors-file;Custom_TraditionalFileFormat $InputTCPServerBindRuleset production $InputTCPServerRun 10514 So, for the most part everything works normally, and I get files like this: /var/log/company/production/app_location_engine.log /var/log/company/production/app_location_webapp.log But, occasionaly, I'll get odd files like: /var/log/company/production/app_location_webine-errors.log /var/log/company/production/.log However, the app names appear correctly in the syslog tag logged to messages in those files. Any help is much appreciated! -- Brad _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
