Hello Alex, I'm pretty sure it's not rsyslog cutting your messages, but "logger". You might want to try a different app to ship your logs. For example, the simple perl script indicated here: http://www.oreillynet.com/pub/a/sysadmin/2006/10/12/httpd-syslog.html
Best regards, Radu 2013/8/21 Alex Guzhavin <[email protected]> > I am running rsyslog 4.2.0-2ubuntu8.1 on Ubuntu 10.04. My version of > Apache is 2.2.24. Some of my Apache access logs entries are split into > multiple lines. > > I have set $MaxMessageSize 12k in /etc/rsyslog.conf. Is there are any other > directives rsyslog needs? I presume that I am hitting some sort of 1024k > limit, but I am not able to determine how to override it. > > Extract from my logfile is here: > > Aug 20 16:14:11 web1 httpd: 66.87.109.175 www.scrubbed.com - > [20/Aug/2013:16:14:11 -0700] "GET /scrubbed/scrubbed/ HTTP/1.1" 301 - " > http://www.scrubbed.com/scrubbed/"; "Mozilla/5.0 (iPhone; CPU iPhone OS > 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 > Mobile/10B329 Safari/8536.25" "abs=912e8142-827d-4d0f-9f7b-60f5b42ff1b7; > crc=https://www.google.com/; cuc=1377040416727*http://www.scrubbed/r/home; > > optimizelyPendingLogEvents=%5B%22n%3Dengagement%26g%3D86356611%26u%3Doeu1377040426611r0.397338506532833%26t%3D1377040449939%26f%3D194824325%2C156913030%2C238737162%2C224708115%2C238634773%2C238352919%2C238274335%2C277860000%2C201368106%2C284755507%2C249111248%2C286245971%2C272852193%2C279962727%2C247984874%2C286285651%2C272828153%2C252417019%2C300494078%22%5D; > __utma=1.205040350.1377040428.1377040428.1377040428.1; > __utmb=1.1.10.1377040428; __utmc=1; > > __utmz=1.1377040428.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); > optimizelyBuckets=%7B%7D; > optimizelyEndUserId=oeu1377040426611r0.397338506532833; > > Aug 20 16:14:11 web4 httpd: > > optimizelySegments=%7B%22172557497%22%3A%22search%22%2C%22172573914%22%3A%22true%22%2C%22172614763%22%3A%22none%22%2C%22172711282%22%3A%22safari%22%2C%22210294563%22%3A%22true%22%7D; > JSESSIONID=glmy3bAe6t4ir5b5taEcu" 0 > > > > > My Apache log module configuration is listed below: > > <IfModule log_config_module> > # > # The following directives define some format nicknames for use with > # a CustomLog directive (see below). > # > LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" > \"%{User-Agent}i\"" combined > LogFormat "%h %l %u %t \"%r\" %>s %b" common > > LogFormat "%h %v %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\" > \"%{Cookie}i\" %T" ctime > #LogFormat "%{X-Forwarded-For}i %v %u %t \"%r\" %s %b \"%{Referer}i\" > \"%{User-agent}i\" \"%{Cookie}i\" %T" ctime > > <IfModule logio_module> > # You need to enable mod_logio.c to use %I and %O > LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" > \"%{User-Agent}i\" \"%{Cookie}i\" %I %O" combinedio > > </IfModule> > > SetEnvIf Request_URI "^/um\.html$" dontlog > CustomLog logs/access_log ctime env=!dontlog > CustomLog "|/usr/bin/logger -t httpd -p local1.info" ctime > env=!dontlog > </IfModule> > > Thank you in advance for your help on this topic > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
