Hi,
Hi,
I didn't get this problem but I've tried with 7.4 or something.
Can you reproduce this problem in isolation (i.e. except for your
production machines)? If you do, then you can:
a) easily check if the bug was fixed in a later version
b) help somebody else reproduce the problem and fix it or maybe even a
workaround for your version.
Very strange, I'm testing with Rsyslog 7.4.8 and my problem is always
present.
Examples for a period of 1 minute :
RabbitMQ log :
###
=ERROR REPORT==== 9-Jan-2014::10:00:03 ===
error on AMQP connection <0.13019.203>: {ssl_upgrade_error,closed}
(unknown POSIX error)
=INFO REPORT==== 9-Jan-2014::10:00:16 ===
accepting AMQP connection <0.13132.203> (X.X.X.X:60843 -> X.X.X.X:5671)
=INFO REPORT==== 9-Jan-2014::10:00:18 ===
accepting AMQP connection <0.13145.203> (X.X.X.X:60847 -> X.X.X.X:5671)
=ERROR REPORT==== 9-Jan-2014::10:00:21 ===
error on AMQP connection <0.13132.203>: {ssl_upgrade_error,closed}
(unknown POSIX error)
=ERROR REPORT==== 9-Jan-2014::10:00:23 ===
error on AMQP connection <0.13145.203>: {ssl_upgrade_error,closed}
(unknown POSIX error)
###
RSyslog output :
###
=ERROR REPORT==== 9-Jan-2014::10:00:21 ===#012error on AMQP connection
<0.13132.203>: {ssl_upgrade_error,closed} (unknown POSIX error)
=INFO REPORT==== 9-Jan-2014::10:00:16 ===#012accepting AMQP connection
<0.13132.203> (X.X.X.X:60843 -> X.X.X.X:5671)
###
tcpdump gives the same result that rsyslog. It seems Rsyslog drops some
multiline...
With valgrant I saw some "deleted", is this normal?
###
5245.516127514:9692700: stream checking for file change on
'/var/log/rabbitmq/[email protected]', inode 23229/23229
5245.516272268:7689700: we deleted 3 objects and enqueued 0 objects
5245.516353536:7689700: delete batch from store, new sizes: log 0, phys 0
5245.516436979:7689700: regular consumer finished, iret=4, szlog 0 sz phys 0
5245.516536782:7689700: main Q:Reg/w0: worker IDLE, waiting for work.
###
Best regards,
Dle
Best regards,
Radu
2014/1/7 DuyLong Le <[email protected]
<mailto:[email protected]>>
Hi,
I use "ReadMode" option in order to parse RabbitMQ logs.
I have a problem because I lose a lot of messages. All multiline
events are not forwarding and tcpdump can confirm it.
My configuration is very basic :
###
$ModLoad imfile.so
$InputFileName /var/log/rabbitmq/rabbit@plop.__log
$InputFileTag rabbitmq:
$InputFileStateFile stat-rabbitmq
$InputFileSeverity info
$InputFileFacility local1
$InputFileReadMode 1
$InputRunFileMonitor
*.* @@(o)forward_host;RSYSLOG___ForwardFormat
###
OS : Redhat 6.2
Rsyslog version : 5.8.10
Somebody has already this problem or reproduce it ? I have the same
problem on all machines.
No problem when I remove the ReadMode option but I need multiline.
Moreover, I cannot update the Rsyslog version.
Thanks for your help.
Dle
_________________________________________________
rsyslog mailing list
http://lists.adiscon.net/__mailman/listinfo/rsyslog
<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/__professional-services/
<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
