If you write the logs to a local file do they show up?
including the newline in the message is a significant chance for confusion, but
I think you are working around that with the (o)
are single-line logs getting sent properly? (i.e. are you sure that it's the
multiline logs that's causing the problem, not some other problem with the
connection?)
David Lang
On Tue, 21 Jan 2014, DuyLong Le wrote:
Date: Tue, 21 Jan 2014 15:32:35 +0100
From: DuyLong Le <[email protected]>
Reply-To: [email protected], rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Lost messages with the readmode option
Hi,
I return to my problem because I still have not found a solution.
I tried also with ElasticSearch logs ("ReadMode" option to 2) and I have the
same problem.
If you can, do not hesitate to let me know that it works for you.
I feel that the last message is ignored every time when waiting for new
messages.
Best regards,
Dle
Le 07/01/2014 15:57, DuyLong Le a écrit :
Hi,
I use "ReadMode" option in order to parse RabbitMQ logs.
I have a problem because I lose a lot of messages. All multiline events
are not forwarding and tcpdump can confirm it.
My configuration is very basic :
###
$ModLoad imfile.so
$InputFileName /var/log/rabbitmq/[email protected]
$InputFileTag rabbitmq:
$InputFileStateFile stat-rabbitmq
$InputFileSeverity info
$InputFileFacility local1
$InputFileReadMode 1
$InputRunFileMonitor
*.* @@(o)forward_host;RSYSLOG_ForwardFormat
###
OS : Redhat 6.2
Rsyslog version : 5.8.10
Somebody has already this problem or reproduce it ? I have the same
problem on all machines.
No problem when I remove the ReadMode option but I need multiline.
Moreover, I cannot update the Rsyslog version.
Thanks for your help.
Dle
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
