> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Florian Crouzat > Sent: Thursday, June 14, 2012 11:01 AM > To: [email protected] > Subject: Re: [rsyslog] %msg% is missing a part of the message received in > %rawmsg% > > Le 14/06/2012 10:46, Florian Crouzat a écrit : > > Hi, > > > > Since a couple weeks I started configuring jboss to log through syslog > > using a syslog log4j appender. Everything is fine except I sometimes > > miss a part of the very first line of some stacktraces. > > > > My configuration is the following, jboss -> log4j -> rsyslog -> server.log. > > I created a raw template for comparison. > > > > $template jbossFormat,"%timegenerated% host.example.com jboss: > %msg%\n" > > $template jbossFormatRAW,"%rawmsg%\n" > > local2.* /var/log/jboss/server.log;jbossFormat > > local2.* /var/log/jboss/raw.log;jbossFormatRAW > > local2.* ~ > > > > As you can see, one use %msg%, the other %rawmsg%. > > My problem: there is a difference between the "message" part of the two > > template, see http://pastie.org/4085022 > > > > Line 2 of the jbossFormat template is missing the > > "com.foo.bar.baz.exception.InvalidSessionException:" part. > > > > It seems jboss and log4j are working fine since it's present in %rawmsg% > > so why it doesn't reach %msg% ? > > > > Thanks in advance. > > > > I think I get it, but I'd like confirmation, and maybe even a solution > (not using Java would be a great one, yes) > Java stacktraces are multilines. Only the first line goes through the > log4j pattern layout. So a stacktrace in %rawmsg% looks like this: > > > <148>local2:WARN [ 1.2.3.4 ] [InternalTransactionOperationManagerBean > ] - Transaction error ! > <148>foo.bar.exception.TransactionException: fooError = transaction.notfound > <148> at > foo.bar..manager.transaction.cancel(TransactionOperation.java:323) > <148> at sun.reflect.GeneratedMethodAccessor1234.invoke(Unknown Source) > <148> at > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI > mpl.java:48) > > As I already said, lines 1,3,4 & 5 are logged "properly", line is > complete and prepended by my rsyslog template header. > > Line 2 isn't. My guess: rsyslog thinks that > "foo.bar.exception.TransactionException:" is the syslogfacility and > removes it for %msg% as it's not "the message". > > Could it be so ?
Yeah, the default log4j syslog appender is know to emit severely malformed messages. You may find this small appender useful: http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/ In any case, I think the rsyslog parser also screws up in line 2. I (think) I would expect that "foo.bar..." ends up as tag. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
