On Fri, 2 Aug 2013, Zippy Zeppoli wrote:
"the other option is to change your Java app to deliver the log directly to
syslog rather than just writting it to disk. The stock java log4j doesn't
do this well, but there are multiple replacements available that do better."
Whats the advantage of doing this over reading straight from a file?
you avoid file I/O
you don't have to worry about rotating files or having the disk fill up
rsyslog doesn't have to poll the file (load again)
you don't have to worry about parsing the file to determine which lines need to
be merged (I've seen java error messages that include newlines, which would
break the parser that's trying to figure out which lines go together)
you can deliver the messages directly to a remote box (further reducing load on
the local box)
David Lang
On Thu, Aug 1, 2013 at 6:05 PM, David Lang <[email protected]> wrote:
what version are you running? it's possible that your version is too old
for that (if it is, you should get an error message at startup)
the other option is to change your Java app to deliver the log directly to
syslog rather than just writting it to disk. The stock java log4j doesn't
do this well, but there are multiple replacements available that do better.
David Lang
On Thu, 1 Aug 2013, Zippy Zeppoli wrote:
Date: Thu, 1 Aug 2013 17:00:51 -0700
From: Zippy Zeppoli <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] java exception stacktrace support on CentOS
changing readmode didn't help. I tried changing it to 0,1,2 and 3 and it
didn't seem to behave differently. is that my last option?
On Thu, Aug 1, 2013 at 2:31 PM, David Lang <[email protected]> wrote:
On Thu, 1 Aug 2013, Zippy Zeppoli wrote:
Hello,
I am having a problem where I am reading from a file, and it is a JBoss
application server log, so it logs large stacktraces with many newlines,
but each line is being interpreted as a log message.
Any ideas on how to fix it?
There are two ways to address this.
Using imfile you can change the readmode
by default it reads each line as an independant log entry
but you can change it so that it holds off on delivering one log message
until it sees the beginning of the next log message (allowing it to
combine
multiple lines into one log message), the definition of a new log message
can be a line that doesn't begin with whitespace (which is probably what
you need for Java stack traces) or a blank line between entries (two
newlines back to back)
http://www.rsyslog.com/doc/****imfile.html<http://www.rsyslog.com/doc/**imfile.html>
<http://www.**rsyslog.com/doc/imfile.html<http://www.rsyslog.com/doc/imfile.html>
The other approach is to change how your java code is delivering the log.
Instead of just writing it to disk and having another process scrape the
file (and try to interpret the file), you can have your Java code log
directly to syslog, at which point there is no ambguity about what each
message is.
David Lang
______________________________****_________________
rsyslog mailing list
http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
<http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
<http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
