On Fri, 2 Aug 2013, Zippy Zeppoli wrote:
Hi Eric,
I haven't tried the log4j option yet but it seems like thats the
recommended method and I am keeping it in mind.
However, I am wondering if anyone out there in rsyslog land is successfully
logging stack traces using the file appender?
The only documentation I've seen says
$InputFileReadMode 2
$EscapeControlCharactersOnReceive off
Should do it and fix the problem, but it doesn't seem to do anything.
actually, I think you need to allow it to escape control characters.
without escaping the control characters (including the newline), additional
processing of the log message as it's sent from machine to machine may cause it
to be split again.
what exactly are you seeing that's telling you that this isn't working?
David Lang
On Fri, Aug 2, 2013 at 12:18 PM, Eric Black <[email protected]> wrote:
Heya,
So I ran into this problem as well. I was able to solve it with this log4j
appender layout.
<appender name="syslog-appender"
class="org.apache.log4j.net.SyslogAppender">
<param name="SyslogHost" value="10.200.11.182"/>
<param name="Facility" value="USER"/>
<param name="FacilityPrinting" value="true"/>
<layout class="org.apache.log4j.EnhancedPatternLayout">
<!-- notice the ConversionPattern is the same with the
difference of %m%throwable%n
which prints the stack trace as a single %m escaping the
control characters -->
<param name="ConversionPattern" value="%-5p | %d{MM-dd-yyyy
HH:mm:ss.SSS} | %t | %c(0) - %m%throwable%n"/>
</layout>
</appender>
Specifically the throwable option. Hopefully this is helpful for you.
Eric
On Fri, Aug 2, 2013 at 12:14 PM, Zippy Zeppoli <[email protected]
wrote:
Here is what it looks like on boot:
Aug 2 12:14:07 rsyslog-server kernel: Kernel logging (proc) stopped.
Aug 2 12:14:07 rsyslog-server rsyslogd: [origin software="rsyslogd"
swVersion="5.8.10" x-pid="1307" x-info="http://www.rsyslog.com";] exiting
on
signal 15.
Aug 2 12:14:07 rsyslog-server kernel: imklog 5.8.10, log source =
/proc/kmsg started.
Aug 2 12:14:07 rsyslog-server rsyslogd: [origin software="rsyslogd"
swVersion="5.8.10" x-pid="1327" x-info="http://www.rsyslog.com";] start
On Fri, Aug 2, 2013 at 11:31 AM, Zippy Zeppoli <[email protected]
wrote:
here is the version. sorry about the double reply.
[root@rsyslog-server ~]# rpm -q rsyslog
rsyslog-5.8.10-6.el6.x86_64
[root@rsyslog-server ~]# cat /etc/issue
CentOS release 6.3 (Final)
Kernel \r on an \m
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
