> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Brian Knox > Sent: Thursday, June 14, 2012 2:26 PM > To: rsyslog-users > Subject: Re: [rsyslog] %msg% is missing a part of the message received > in %rawmsg% > > You also might want to give Syslog4j a look - http://syslog4j.org/ > > I don't know specifically if it will solve your issue but it can be > used as > a log4j appender.
The appender that I wrote about uses the syslog4j plumbing and just enhances it by RFC5424 compliance. Also, IIRC, syslog4j doesn't properly handle stacktraces. Just my 2cts, Rainer > Brian > > On Thu, Jun 14, 2012 at 8:00 AM, Florian Crouzat > <[email protected]>wrote: > > > Le 14/06/2012 12:32, Rainer Gerhards a écrit : > > > >> > >> > >> -----Original Message----- > >>> From: [email protected].**com<rsyslog- > [email protected]>[mailto: > >>> rsyslog- > >>> [email protected]] On Behalf Of Florian Crouzat > >>> Sent: Thursday, June 14, 2012 11:01 AM > >>> To: [email protected] > >>> Subject: Re: [rsyslog] %msg% is missing a part of the message > received in > >>> %rawmsg% > >>> > >>> Le 14/06/2012 10:46, Florian Crouzat a écrit : > >>> > >>>> Hi, > >>>> > >>>> Since a couple weeks I started configuring jboss to log through > syslog > >>>> using a syslog log4j appender. Everything is fine except I > sometimes > >>>> miss a part of the very first line of some stacktraces. > >>>> > >>>> My configuration is the following, jboss -> log4j -> rsyslog -> > >>>> server.log. > >>>> I created a raw template for comparison. > >>>> > >>>> $template jbossFormat,"%timegenerated% host.example.com jboss: > >>>> > >>> %msg%\n" > >>> > >>>> $template jbossFormatRAW,"%rawmsg%\n" > >>>> local2.* /var/log/jboss/server.log;**jbossFormat > >>>> local2.* /var/log/jboss/raw.log;**jbossFormatRAW > >>>> local2.* ~ > >>>> > >>>> As you can see, one use %msg%, the other %rawmsg%. > >>>> My problem: there is a difference between the "message" part of > the two > >>>> template, see http://pastie.org/4085022 > >>>> > >>>> Line 2 of the jbossFormat template is missing the > >>>> "com.foo.bar.baz.exception.**InvalidSessionException:" part. > >>>> > >>>> It seems jboss and log4j are working fine since it's present in > %rawmsg% > >>>> so why it doesn't reach %msg% ? > >>>> > >>>> Thanks in advance. > >>>> > >>>> > >>> I think I get it, but I'd like confirmation, and maybe even a > solution > >>> (not using Java would be a great one, yes) > >>> Java stacktraces are multilines. Only the first line goes through > the > >>> log4j pattern layout. So a stacktrace in %rawmsg% looks like this: > >>> > >>> > >>> <148>local2:WARN [ 1.2.3.4 ] [**InternalTransactionOperationMa** > >>> nagerBean > >>> ] - Transaction error ! > >>> <148>foo.bar.exception.**TransactionException: fooError = > >>> transaction.notfound > >>> <148> at > >>> > foo.bar..manager.transaction.**cancel(TransactionOperation.**java:323) > >>> <148> at > sun.reflect.**GeneratedMethodAccessor1234.**invoke(Unknown > >>> Source) > >>> <148> at > >>> sun.reflect.**DelegatingMethodAccessorImpl.**invoke(** > >>> DelegatingMethodAccessorI > >>> mpl.java:48) > >>> > >>> As I already said, lines 1,3,4& 5 are logged "properly", line is > >>> > >>> complete and prepended by my rsyslog template header. > >>> > >>> Line 2 isn't. My guess: rsyslog thinks that > >>> "foo.bar.exception.**TransactionException:" is the syslogfacility > and > >>> removes it for %msg% as it's not "the message". > >>> > >>> Could it be so ? > >>> > >> > >> Yeah, the default log4j syslog appender is know to emit severely > >> malformed messages. You may find this small appender useful: > >> > >> http://www.rsyslog.com/tcp-**syslog-rfc5424-log4j- > appender/<http://www.rsyslog.com/tcp-syslog-rfc5424-log4j-appender/> > >> > >> In any case, I think the rsyslog parser also screws up in line 2. I > >> (think) I would expect that "foo.bar..." ends up as tag. > >> > >> Rainer > >> > > > > Thanks for your quick answer. > > So it what I was afraid of, the first part of the line is considered > as a > > tag... > > Thanks for suggesting your appender, your already mentionned it in > another > > mail exchange we had and I think I can't really use it because of > security > > constraints. > > > > I'll see what I kind do, either in Java or I'll use %rawmsg% in my > regular > > template. > > > > -- > > Cheers, > > Florian Crouzat > > > > ______________________________**_________________ > > rsyslog mailing list > > > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adisco > n.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional- > services/<http://www.rsyslog.com/professional-services/> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
