I had a look at the debug log posted some time ago,but I did not see anything unusual. As this looks like it is related to the network, could you post a capture that I can look into with wireshark? Or maybe mail it privately to me and (if OK with him) David?
Rainer On Wed, Jan 22, 2014 at 9:54 AM, DuyLong Le <[email protected]>wrote: > If you write the logs to a local file do they show up? >> > > The events are well written to a local file. To check, I watch the file > (tail -f) and network output (tcpdump) but I do not have the same. > > > >> including the newline in the message is a significant chance for >> confusion, but I think you are working around that with the (o) >> >> > Yes, I use (o) in order to forward messages. > > > are single-line logs getting sent properly? (i.e. are you sure that it's >> the multiline logs that's causing the problem, not some other problem >> with the connection?) >> > > No problem with connection because I have messages that are transferred > but partially (checked with tcpdump). > > Only disabling "ReadMode" allows me to have all messages but I lost > multiline. > > Dle > > > >> David Lang >> >> On Tue, 21 Jan 2014, DuyLong Le wrote: >> >> Date: Tue, 21 Jan 2014 15:32:35 +0100 >>> From: DuyLong Le <[email protected]> >>> Reply-To: [email protected], rsyslog-users <[email protected] >>> > >>> To: rsyslog-users <[email protected]> >>> Subject: Re: [rsyslog] Lost messages with the readmode option >>> >>> Hi, >>> >>> I return to my problem because I still have not found a solution. >>> >>> I tried also with ElasticSearch logs ("ReadMode" option to 2) and I >>> have the same problem. >>> >>> If you can, do not hesitate to let me know that it works for you. >>> >>> I feel that the last message is ignored every time when waiting for >>> new messages. >>> >>> Best regards, >>> >>> Dle >>> >>> Le 07/01/2014 15:57, DuyLong Le a écrit : >>> >>>> Hi, >>>> >>>> I use "ReadMode" option in order to parse RabbitMQ logs. >>>> >>>> I have a problem because I lose a lot of messages. All multiline events >>>> are not forwarding and tcpdump can confirm it. >>>> >>>> My configuration is very basic : >>>> >>>> ### >>>> $ModLoad imfile.so >>>> >>>> $InputFileName /var/log/rabbitmq/[email protected] >>>> $InputFileTag rabbitmq: >>>> $InputFileStateFile stat-rabbitmq >>>> $InputFileSeverity info >>>> $InputFileFacility local1 >>>> $InputFileReadMode 1 >>>> $InputRunFileMonitor >>>> >>>> *.* @@(o)forward_host;RSYSLOG_ForwardFormat >>>> ### >>>> >>>> OS : Redhat 6.2 >>>> Rsyslog version : 5.8.10 >>>> >>>> Somebody has already this problem or reproduce it ? I have the same >>>> problem on all machines. >>>> No problem when I remove the ReadMode option but I need multiline. >>>> Moreover, I cannot update the Rsyslog version. >>>> >>>> Thanks for your help. >>>> >>>> Dle >>>> >>> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
