I am running rsyslog 4.2.0-2ubuntu8.1 on Ubuntu 10.04. My version of Apache is 2.2.24. Some of my Apache access logs entries are split into multiple lines.
I have set $MaxMessageSize 12k in /etc/rsyslog.conf. Is there are any other directives rsyslog needs? I presume that I am hitting some sort of 1024k limit, but I am not able to determine how to override it. Extract from my logfile is here: Aug 20 16:14:11 web1 httpd: 66.87.109.175 www.scrubbed.com - [20/Aug/2013:16:14:11 -0700] "GET /scrubbed/scrubbed/ HTTP/1.1" 301 - " http://www.scrubbed.com/scrubbed/"; "Mozilla/5.0 (iPhone; CPU iPhone OS 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B329 Safari/8536.25" "abs=912e8142-827d-4d0f-9f7b-60f5b42ff1b7; crc=https://www.google.com/; cuc=1377040416727*http://www.scrubbed/r/home; optimizelyPendingLogEvents=%5B%22n%3Dengagement%26g%3D86356611%26u%3Doeu1377040426611r0.397338506532833%26t%3D1377040449939%26f%3D194824325%2C156913030%2C238737162%2C224708115%2C238634773%2C238352919%2C238274335%2C277860000%2C201368106%2C284755507%2C249111248%2C286245971%2C272852193%2C279962727%2C247984874%2C286285651%2C272828153%2C252417019%2C300494078%22%5D; __utma=1.205040350.1377040428.1377040428.1377040428.1; __utmb=1.1.10.1377040428; __utmc=1; __utmz=1.1377040428.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); optimizelyBuckets=%7B%7D; optimizelyEndUserId=oeu1377040426611r0.397338506532833; Aug 20 16:14:11 web4 httpd: optimizelySegments=%7B%22172557497%22%3A%22search%22%2C%22172573914%22%3A%22true%22%2C%22172614763%22%3A%22none%22%2C%22172711282%22%3A%22safari%22%2C%22210294563%22%3A%22true%22%7D; JSESSIONID=glmy3bAe6t4ir5b5taEcu" 0 My Apache log module configuration is listed below: <IfModule log_config_module> # # The following directives define some format nicknames for use with # a CustomLog directive (see below). # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined LogFormat "%h %l %u %t \"%r\" %>s %b" common LogFormat "%h %v %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\" \"%{Cookie}i\" %T" ctime #LogFormat "%{X-Forwarded-For}i %v %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\" \"%{Cookie}i\" %T" ctime <IfModule logio_module> # You need to enable mod_logio.c to use %I and %O LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{Cookie}i\" %I %O" combinedio </IfModule> SetEnvIf Request_URI "^/um\.html$" dontlog CustomLog logs/access_log ctime env=!dontlog CustomLog "|/usr/bin/logger -t httpd -p local1.info" ctime env=!dontlog </IfModule> Thank you in advance for your help on this topic _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
