If you write the logs to a local file do they show up?
The events are well written to a local file. To check, I watch the file
(tail -f) and network output (tcpdump) but I do not have the same.
including the newline in the message is a significant chance for
confusion, but I think you are working around that with the (o)
Yes, I use (o) in order to forward messages.
are single-line logs getting sent properly? (i.e. are you sure that it's
the multiline logs that's causing the problem, not some other problem
with the connection?)
No problem with connection because I have messages that are transferred
but partially (checked with tcpdump).
Only disabling "ReadMode" allows me to have all messages but I lost
multiline.
Dle
David Lang
On Tue, 21 Jan 2014, DuyLong Le wrote:
Date: Tue, 21 Jan 2014 15:32:35 +0100
From: DuyLong Le <[email protected]>
Reply-To: [email protected], rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Lost messages with the readmode option
Hi,
I return to my problem because I still have not found a solution.
I tried also with ElasticSearch logs ("ReadMode" option to 2) and I
have the same problem.
If you can, do not hesitate to let me know that it works for you.
I feel that the last message is ignored every time when waiting for
new messages.
Best regards,
Dle
Le 07/01/2014 15:57, DuyLong Le a écrit :
Hi,
I use "ReadMode" option in order to parse RabbitMQ logs.
I have a problem because I lose a lot of messages. All multiline events
are not forwarding and tcpdump can confirm it.
My configuration is very basic :
###
$ModLoad imfile.so
$InputFileName /var/log/rabbitmq/[email protected]
$InputFileTag rabbitmq:
$InputFileStateFile stat-rabbitmq
$InputFileSeverity info
$InputFileFacility local1
$InputFileReadMode 1
$InputRunFileMonitor
*.* @@(o)forward_host;RSYSLOG_ForwardFormat
###
OS : Redhat 6.2
Rsyslog version : 5.8.10
Somebody has already this problem or reproduce it ? I have the same
problem on all machines.
No problem when I remove the ReadMode option but I need multiline.
Moreover, I cannot update the Rsyslog version.
Thanks for your help.
Dle
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
