On Thu, 9 Jan 2014, DuyLong Le wrote:
Hi,
Hi,
I didn't get this problem but I've tried with 7.4 or something.
Can you reproduce this problem in isolation (i.e. except for your
production machines)? If you do, then you can:
a) easily check if the bug was fixed in a later version
b) help somebody else reproduce the problem and fix it or maybe even a
workaround for your version.
Very strange, I'm testing with Rsyslog 7.4.8 and my problem is always
present.
setup the impstats module, it will give you far more information about what's
happening.
David Lang
Examples for a period of 1 minute :
RabbitMQ log :
###
=ERROR REPORT==== 9-Jan-2014::10:00:03 ===
error on AMQP connection <0.13019.203>: {ssl_upgrade_error,closed} (unknown
POSIX error)
=INFO REPORT==== 9-Jan-2014::10:00:16 ===
accepting AMQP connection <0.13132.203> (X.X.X.X:60843 -> X.X.X.X:5671)
=INFO REPORT==== 9-Jan-2014::10:00:18 ===
accepting AMQP connection <0.13145.203> (X.X.X.X:60847 -> X.X.X.X:5671)
=ERROR REPORT==== 9-Jan-2014::10:00:21 ===
error on AMQP connection <0.13132.203>: {ssl_upgrade_error,closed} (unknown
POSIX error)
=ERROR REPORT==== 9-Jan-2014::10:00:23 ===
error on AMQP connection <0.13145.203>: {ssl_upgrade_error,closed} (unknown
POSIX error)
###
RSyslog output :
###
=ERROR REPORT==== 9-Jan-2014::10:00:21 ===#012error on AMQP connection
<0.13132.203>: {ssl_upgrade_error,closed} (unknown POSIX error)
=INFO REPORT==== 9-Jan-2014::10:00:16 ===#012accepting AMQP connection
<0.13132.203> (X.X.X.X:60843 -> X.X.X.X:5671)
###
tcpdump gives the same result that rsyslog. It seems Rsyslog drops some
multiline...
With valgrant I saw some "deleted", is this normal?
###
5245.516127514:9692700: stream checking for file change on
'/var/log/rabbitmq/[email protected]', inode 23229/23229
5245.516272268:7689700: we deleted 3 objects and enqueued 0 objects
5245.516353536:7689700: delete batch from store, new sizes: log 0, phys 0
5245.516436979:7689700: regular consumer finished, iret=4, szlog 0 sz phys 0
5245.516536782:7689700: main Q:Reg/w0: worker IDLE, waiting for work.
###
Best regards,
Dle
Best regards,
Radu
2014/1/7 DuyLong Le <[email protected]
<mailto:[email protected]>>
Hi,
I use "ReadMode" option in order to parse RabbitMQ logs.
I have a problem because I lose a lot of messages. All multiline
events are not forwarding and tcpdump can confirm it.
My configuration is very basic :
###
$ModLoad imfile.so
$InputFileName /var/log/rabbitmq/rabbit@plop.__log
$InputFileTag rabbitmq:
$InputFileStateFile stat-rabbitmq
$InputFileSeverity info
$InputFileFacility local1
$InputFileReadMode 1
$InputRunFileMonitor
*.* @@(o)forward_host;RSYSLOG___ForwardFormat
###
OS : Redhat 6.2
Rsyslog version : 5.8.10
Somebody has already this problem or reproduce it ? I have the same
problem on all machines.
No problem when I remove the ReadMode option but I need multiline.
Moreover, I cannot update the Rsyslog version.
Thanks for your help.
Dle
_________________________________________________
rsyslog mailing list
http://lists.adiscon.net/__mailman/listinfo/rsyslog
<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/__professional-services/
<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
