Le 14/06/2012 12:32, Rainer Gerhards a écrit :
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Florian Crouzat
Sent: Thursday, June 14, 2012 11:01 AM
To: [email protected]
Subject: Re: [rsyslog] %msg% is missing a part of the message received in
%rawmsg%
Le 14/06/2012 10:46, Florian Crouzat a écrit :
Hi,
Since a couple weeks I started configuring jboss to log through syslog
using a syslog log4j appender. Everything is fine except I sometimes
miss a part of the very first line of some stacktraces.
My configuration is the following, jboss -> log4j -> rsyslog -> server.log.
I created a raw template for comparison.
$template jbossFormat,"%timegenerated% host.example.com jboss:
%msg%\n"
$template jbossFormatRAW,"%rawmsg%\n"
local2.* /var/log/jboss/server.log;jbossFormat
local2.* /var/log/jboss/raw.log;jbossFormatRAW
local2.* ~
As you can see, one use %msg%, the other %rawmsg%.
My problem: there is a difference between the "message" part of the two
template, see http://pastie.org/4085022
Line 2 of the jbossFormat template is missing the
"com.foo.bar.baz.exception.InvalidSessionException:" part.
It seems jboss and log4j are working fine since it's present in %rawmsg%
so why it doesn't reach %msg% ?
Thanks in advance.
I think I get it, but I'd like confirmation, and maybe even a solution
(not using Java would be a great one, yes)
Java stacktraces are multilines. Only the first line goes through the
log4j pattern layout. So a stacktrace in %rawmsg% looks like this:
<148>local2:WARN [ 1.2.3.4 ] [InternalTransactionOperationManagerBean
] - Transaction error !
<148>foo.bar.exception.TransactionException: fooError = transaction.notfound
<148> at
foo.bar..manager.transaction.cancel(TransactionOperation.java:323)
<148> at sun.reflect.GeneratedMethodAccessor1234.invoke(Unknown Source)
<148> at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI
mpl.java:48)
As I already said, lines 1,3,4& 5 are logged "properly", line is
complete and prepended by my rsyslog template header.
Line 2 isn't. My guess: rsyslog thinks that
"foo.bar.exception.TransactionException:" is the syslogfacility and
removes it for %msg% as it's not "the message".
Could it be so ?
Yeah, the default log4j syslog appender is know to emit severely malformed
messages. You may find this small appender useful:
http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/
In any case, I think the rsyslog parser also screws up in line 2. I (think) I would
expect that "foo.bar..." ends up as tag.
Rainer
Thanks for your quick answer.
So it what I was afraid of, the first part of the line is considered as
a tag...
Thanks for suggesting your appender, your already mentionned it in
another mail exchange we had and I think I can't really use it because
of security constraints.
I'll see what I kind do, either in Java or I'll use %rawmsg% in my
regular template.
--
Cheers,
Florian Crouzat
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
