On Wed, 6 Feb 2013, Brian Harris wrote:
Ok, it seems when I enable debug on demand all logs start to show up but
once I disable debug its sporadically sending them again.
And note that this only happens for a few monitored files and not the rest.
hmm, this will make it harder to track down, anything you can think of that's
different between ones where it works and ones where it doesn't?
I couldn't get ReadMode 1 to work for java exceptions so I found some
rsyslog documentation to use ReadMode 2 for indent and that actually works
me.
yeah, that's what the readmode was created for :-)
as a test, could you leave it with the default readmode (which will make each
line of the java code be a different log message) and see if you have the same
problem, just to rule out of that is part of the problem?
Where is the best place to post debug logs?
you can't send them to the list, but private e-mail to Rainer and/or me will
work (Rainer is much more familiar with things, but is short of time)
posting them on dropbox or something like that and sending a link can also work.
David Lang
On Wed, Feb 6, 2013 at 8:01 AM, Rainer Gerhards <[email protected]>wrote:
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of David Lang
Sent: Wednesday, February 06, 2013 7:21 AM
To: rsyslog-users
Subject: Re: [rsyslog] Imfile sporadically sending messages
It's very unlikely that the problem is keeping up
read mode 2 means that it can't consider a log paragraph read until it
has the
beginning of the next log message (it doesn't know if there is more data
pending on the log it's got)
I think that Rainer will need to take a look at this, is there anything
showing
up in a debug run?
Just to chime in that I am unfortunately extremely busy at the moment. I
can have a quick lock at the debug log, but not more, probably for the next
2 weeks. Sorry for that,
Rainer
David Lang
On Tue, 5 Feb 2013, Brian Harris wrote:
I use rsyslog and the imfile module to watch some application logs and
send to a central syslog server.
imfile is sporadically sending messages to the remote server. On a few
servers it works as expected but it isn't consistent.
I receive about 191 new events (lines) per minute and its only sending
a few messages every couple of minutes.
A tcpdump confirmed the all messages are not being sent from the host.
rsyslog-5.10.1-4.el5.centos.x86_64.rpm
ReadMode 2 works indented and not 1 not like the doc says.
http://www.rsyslog.com/doc/imfile.html
Is it possible that it can't keep up? I watch the state files and it
doesn't seem like they update at all after they are created.
#Sample Config
$ModLoad imfile
#Watch java app log with multiline support $InputFileName
/logs/app1.log $InputFileReadMode 2 $InputFileTag app1-log:
$InputFileStateFile state-app1-log
$InputFileFacility local6
$InputFileSeverity debug
$InputRunFileMonitor
#Watch app access log
$InputFileName /logs/app1-access.log
$InputFileTag app1-access:
$InputFileStateFile state-app1-access
$InputFileFacility local7
$InputFileSeverity debug
$InputRunFileMonitor
*.* @syslog:5144
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond
our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
