Hello,
I come to you about my problem unsolved. I use Rsyslog 8.0 to run some
tests.
* In all cases, the examples below do not work. Rsyslog does not
transfer messages.
echo -e "=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly" >>
/var/log/rabbitmq/rabbit\@plop.log (normal, no blank line)
echo -e "\n=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly" >>
/var/log/rabbitmq/rabbit\@plop.log (blank line exist)
Rsyslog seems detected the modification but does not go far in the
treatment :
############
# Receive a new event...
8912.800827607:7f19e2183700: DDDD: imfile event notification: rd 16[0],
wd (3, mask 00000002, cookie 0000, len 0)
8912.800835413:7f19e2183700: watch was MODIFID
8912.800838865:7f19e2183700: DDDD: imfile: wd 3 got file 0, dir -1
8912.800853129:7f19e2183700: strm 0x7f19dfc14300: file 7 read 156 bytes
8912.800864495:7f19e2183700: strm 0x7f19dfc14300: file 7 read 0 bytes
8912.800871360:7f19e2183700: stream checking for file change on
'/var/log/rabbitmq/[email protected]', inode 30007/30007
# Wait new event...
############
* I add a "\n" to the end and everything seems to work with the previous
examples.
echo -e "=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly\n" >>
/var/log/rabbitmq/rabbit\@plop.log
echo -e "\n=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly\n" >>
/var/log/rabbitmq/rabbit\@plop.log
Do you have a solution because I have the same problem with others
applications ? I tested with the PollingInterval but without result
Best regards,
--
Dle
Le 07/01/2014 15:57, DuyLong Le a écrit :
> Hi,
>
> I use "ReadMode" option in order to parse RabbitMQ logs.
>
> I have a problem because I lose a lot of messages. All multiline events
> are not forwarding and tcpdump can confirm it.
>
> My configuration is very basic :
>
> ###
> $ModLoad imfile.so
>
> $InputFileName /var/log/rabbitmq/[email protected]
> $InputFileTag rabbitmq:
> $InputFileStateFile stat-rabbitmq
> $InputFileSeverity info
> $InputFileFacility local1
> $InputFileReadMode 1
> $InputRunFileMonitor
>
> *.* @@(o)forward_host;RSYSLOG_ForwardFormat
> ###
>
> OS : Redhat 6.2
> Rsyslog version : 5.8.10
>
> Somebody has already this problem or reproduce it ? I have the same
> problem on all machines.
> No problem when I remove the ReadMode option but I need multiline.
> Moreover, I cannot update the Rsyslog version.
>
> Thanks for your help.
>
> Dle
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
