I had a look at the debug log posted some time ago,but I did not see
anything unusual. As this looks like it is related to the network, could
you post a capture that I can look into with wireshark? Or maybe mail it
privately to me and (if OK with him) David?
Before you send a debug network, here is another test that confirms my
losses:
## Rsyslog configuration ##
input(type="imfile" File="/var/log/rabbitmq/[email protected]"
Tag="rabbitmq:"
StateFile="stat-rabbitmq"
Severity="info"
ReadMode="1"
Facility="local2")
$template RSYSLOG_TEST_Format,"%msg%\n"
local2.*
-/var/log/local2.log;RSYSLOG_TEST_Format
## RabbitMQ log ##
=INFO REPORT==== 22-Jan-2014::12:10:41 ===
accepting AMQP connection <0.24984.14> (X.X.X.X:47633 -> X.X.X.X:5672)
=WARNING REPORT==== 22-Jan-2014::12:10:41 ===
closing AMQP connection <0.24984.14> (X.X.X.X:47633 -> X.X.X.X:5672):
connection_closed_abruptly
=INFO REPORT==== 22-Jan-2014::12:13:42 ===
accepting AMQP connection <0.26089.14> (X.X.X.X:47634 -> X.X.X.X:5672)
=WARNING REPORT==== 22-Jan-2014::12:13:42 ===
closing AMQP connection <0.26089.14> (X.X.X.X:47634 -> X.X.X.X:5672):
connection_closed_abruptly
## local2.log ##
=INFO REPORT==== 22-Jan-2014::12:10:41 ===
accepting AMQP connection <0.24984.14> (X.X.X.X:47633 -> X.X.X.X:5672)
=INFO REPORT==== 22-Jan-2014::12:13:42 ===
accepting AMQP connection <0.26089.14> (X.X.X.X:47634 -> X.X.X.X:5672)
No problem without "Readmode".
Dle
Rainer
On Wed, Jan 22, 2014 at 9:54 AM, DuyLong Le
Duy Long Le wrote:
If you write the logs to a local file do they show up?
The events are well written to a local file. To check, I watch the
file (tail -f) and network output (tcpdump) but I do not have the same.
including the newline in the message is a significant chance for
confusion, but I think you are working around that with the (o)
Yes, I use (o) in order to forward messages.
are single-line logs getting sent properly? (i.e. are you sure
that it's
the multiline logs that's causing the problem, not some other
problem
with the connection?)
No problem with connection because I have messages that are
transferred but partially (checked with tcpdump).
Only disabling "ReadMode" allows me to have all messages but I lost
multiline.
Dle
David Lang
On Tue, 21 Jan 2014, DuyLong Le wrote:
Hi,
I return to my problem because I still have not found a
solution.
I tried also with ElasticSearch logs ("ReadMode" option to
2) and I
have the same problem.
If you can, do not hesitate to let me know that it works for
you.
I feel that the last message is ignored every time when
waiting for
new messages.
Best regards,
Dle
Le 07/01/2014 15:57, DuyLong Le a écrit :
Hi,
I use "ReadMode" option in order to parse RabbitMQ logs.
I have a problem because I lose a lot of messages. All
multiline events
are not forwarding and tcpdump can confirm it.
My configuration is very basic :
###
$ModLoad imfile.so
$InputFileName /var/log/rabbitmq/rabbit@plop.__log
$InputFileTag rabbitmq:
$InputFileStateFile stat-rabbitmq
$InputFileSeverity info
$InputFileFacility local1
$InputFileReadMode 1
$InputRunFileMonitor
*.* @@(o)forward_host;RSYSLOG___ForwardFormat
###
OS : Redhat 6.2
Rsyslog version : 5.8.10
Somebody has already this problem or reproduce it ? I
have the same
problem on all machines.
No problem when I remove the ReadMode option but I need
multiline.
Moreover, I cannot update the Rsyslog version.
Thanks for your help.
Dle
_________________________________________________
rsyslog mailing list
http://lists.adiscon.net/__mailman/listinfo/rsyslog
<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/__professional-services/
<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
