hi, Rainer
i upgrade to 5.10.1 , but it doesn't help, just the same.
i will try 6/7 version later, but i don't know is that need a config
file update.
and can i use the OR EXPRESSION in the config file like:
:rawmsg, contains, "INFO|CHAT|DLL_MD5" or "INFO|CHAT|LOGIN"
-?DynFile;MyFileFormat
thanks.
> hi,all
>
> i am using rsyslog 5.8.13 under centos 5.8, with the config like
> below:
>
> $OMFileAsyncWriting on
> $OMFileFlushOnTXEnd off
> $OMFileFlushInterval 30
> $OMFileZipLevel 9
> $OMFileIOBufferSize 256k
>
> $template MyFileFormat,"%timegenerated:::date-rfc3339% %fromhost-ip%
> %rawmsg%\n"
> $template DynFile,"/home/rsyslog/logs/chat.%$now%.%$hour%.log.gz"
>
> :rawmsg, contains, "INFO|CHAT|DLL_MD5" -?DynFile;MyFileFormat
> & ~
> :rawmsg, contains, "INFO|CHAT|LOGIN" -?DynFile;MyFileFormat
> & ~
>
> i use OMFileZipLevel and OMFileIOBufferSize because the log is very
> large.
>
> but i am countering a problem that some messages in the DynFilewill
> mixed
> together in one line like :
>
> 2012-11-20T23:00:18.079471+08:00 114.113.197.94 <134>Nov 20 23:00:18
> xx74-158 xx_202[914]:
> [103991]INFO|CHAT|DLL_MD5,,xxxxx,,712970202,,ntdll.dll|c30a91ade8c9cb91
> e4281ec83c4500c6;kernel32.dll|e570cb2012-11-20T23:00:00.058220+08:00
> 11.11.19.93 <134>Nov 20 23:00:00 xx186-155
> xx_211[4146]:[103991]INFO|CHAT|LOGIN,,xxxxx,,985440211,,8.24.28.15,,51,
> ,3172303-123928576,,ST500DM002-1BD142-
> W2A1EZDK,,2bba83a20faded52cf782c4917991024,,fcb7cd8a0b1ab25e2656261f778
> 5172e,,bff0b3e2bb5d19adc87d4041b38299ec,0,,0,0,0,,0
>
>
> i check the output file and found that rsyslog seems using two threads
> write to the same DynFile.
> thread one handles ':rawmsg, contains, "INFO|CHAT|DLL_MD5" ' condition
> and
> has a 256k buffer.
> thread two handles ':rawmsg, contains, "INFO|CHAT|LOGIN" ' condition
> and
> has another 256k buffer.
>
> this problem happens when thread one flush the buffer to file ,
> and thread two flush its buffer later,
> then this mix will show upbetween the two flushes.
>
> i think the buffer is count exactly by bytes,
> but not consideringmessage,
> so this is the right behavior it should be.
>
> but how can i fix this problem?
That is probably a bug in that (old) version. I suggest to upgrade to a
supported version (or at least 5.10.1) and see if the problem persists. I
think I remember this problem, but not sure.
Rainer
> is it possible to config rsyslog using one thread for the same file?
> or how can i use the OR EXPRESSION in the config file like:
>
> :rawmsg, contains, "INFO|CHAT|DLL_MD5" or "INFO|CHAT|LOGIN"
> -?DynFile;MyFileFormat
>
> thanks for your help.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
