Hi, I am using rsyslog to ship logs to centralized log server. Having *issues with logs having more than one line*.
Tried $InputFileReadMode 1 in client. --- If I send logs to a centralized log server, it will send the first line only. All the other lines are ignored. --- If I write logs to another file in same client machine, it appends time stamp to first line but, *still the log is multi-line. I believe it should be a one liner here escaping new line char.* client version : rsyslogd 5.8.6 Server version: rsyslogd 5.8.11 *My client config:* $ModLoad imfile $InputFileName /tmp/ne.error.log $InputFileTag test.ne.ne-error $InputFileStateFile test.ne.ne-error $InputFileReadMode 1 $InputRunFileMonitor if $syslogtag == 'test.ne.ne-error' then @@172.17.7.9:514 #& ~ if $syslogtag == 'test.ne.ne-error' then /tmp/ne.error.new & ~ *My server (*172.17.7.9*) config:* $template test.ne.ne-error,"/tmp/ne-test.log" if $syslogtag == 'test.ne.ne-error' then ?test.ne.ne-error & ~ Please point out if I am doing anything wrong. -------------------- Tried with following as log: Newline 1 test1 test2 test3 Newline 2 test4 test5 ------------------ In same server, syslog write it as: Aug 30 17:47:50 myhost test.ne.ne-error Newline 1 test1 test2 test3 Aug 30 17:47:50 myhost test.ne.ne-error Newline 2 test4 test5 -------------------- In remote log server it was like this: Aug 30 17:47:50 myhost test.ne.ne-error Newline 1 Aug 30 17:47:50 myhost test.ne.ne-error Newline 2 _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
