what if you aren't using log4j? i am using tomcat which uses a JULI appender.
On Thu, Aug 8, 2013 at 7:24 AM, Eric Black <[email protected]> wrote: > Right, I believe the throwable option change the control character. > > The problem with stack traces coming out of log4j is they use a vertical > tab for a delimiter. Rsyslog picks this up as a control character hence the > multiple entries per stack trace. The conversion pattern in the sample > log4j.xml is appender agnostic so you can use it with file, console, etc. > > So really if you want to work around vertical tabs in rsyslog (which can > have other problems) that works too. > > Sorry for the delayed response, > > Eric > > On Sunday, August 4, 2013, David Lang wrote: > > > On Fri, 2 Aug 2013, Zippy Zeppoli wrote: > > > > Hi Eric, > >> I haven't tried the log4j option yet but it seems like thats the > >> recommended method and I am keeping it in mind. > >> > >> However, I am wondering if anyone out there in rsyslog land is > >> successfully > >> logging stack traces using the file appender? > >> > >> The only documentation I've seen says > >> $InputFileReadMode 2 > >> $**EscapeControlCharactersOnRecei**ve off > >> > >> Should do it and fix the problem, but it doesn't seem to do anything. > >> > > > > actually, I think you need to allow it to escape control characters. > > > > without escaping the control characters (including the newline), > > additional processing of the log message as it's sent from machine to > > machine may cause it to be split again. > > > > what exactly are you seeing that's telling you that this isn't working? > > > > David Lang > > > > > > On Fri, Aug 2, 2013 at 12:18 PM, Eric Black <[email protected]> wrote: > > > > Heya, > > > > So I ran into this problem as well. I was able to solve it with this > log4j > > appender layout. > > > > <appender name="syslog-appender" > > class="org.apache.log4j.net.**SyslogAppender"> > > <param name="SyslogHost" value="10.200.11.182"/> > > <param name="Facility" value="USER"/> > > <param name="FacilityPrinting" value="true"/> > > <layout class="org.apache.log4j.**EnhancedPatternLayout"> > > <!-- notice the ConversionPattern is the same with the > > difference of %m%throwable%n > > which prints the stack trace as a single %m escaping the > > control characters --> > > <param name="ConversionPattern" value="%-5p | %d{MM-dd-yyyy > > HH:mm:ss.SSS} | %t | %c(0) - %m%throwable%n"/> > > </layout> > > </appender> > > > > Specifically the throwable option. Hopefully this is helpful for you. > > > > Eric > > > > > > On Fri, Aug 2, 2013 at 12:14 PM, Zippy Zeppoli <[email protected] > > > > wrote: > > > > > > Here is what it looks like on boot: > > Aug 2 12:14:07 rsyslog-server kernel: Kernel logging (proc) stopped. > > Aug 2 12:14:07 rsyslog-server rsyslogd: [origin software="rsyslogd" > > swVersion="5.8.10" x-pid="1307" x-info="http://www.rsyslog.com**";] > exiting > > on > > signal 15. > > Aug 2 12:14:07 rsyslog-server kernel: imklog 5.8.10, log source = > > /proc/kmsg started. > > Aug 2 12:14:07 rsyslog-server rsyslogd: [origin software="rsyslogd" > > swVersion="5.8.10" x-pid="1327" x-info="http://www.rsyslog.com**";] start > > > > > > On Fri, Aug 2, 2013 at 11:31 AM, Zippy Zeppoli <[email protected] > > > > wrote: > > > > > > here is the version. sorry about the double reply. > > > > [root@rsyslog-server ~]# rpm -q rsyslog > > rsyslog-5.8.10-6.el6.x86_64 > > [root@rsyslog-server ~]# cat /etc/issue > > CentOS release 6.3 (Final) > > Kernel \r on an \m > > > > > > > > ______________________________**_________________ > > rsyslog mailing list > > http://lists.adiscon.net/**mailman/listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional-services/< > http://www.rsyslog.com/professional-services/> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > > ______________________________**_________________ > > rsyslog mailing list > > http://lists.adiscon.net/**mailman/listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional-services/< > http://www.rsyslog.com/professional-services/> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > > ______________________________**_________________ > > rsyslog mailing list > > http://lists.adiscon.net/**mailman/listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional-services/< > http://www.rsyslog.com/professional-services/> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sit > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
