Hi,
How is rsyslog supposed to know that you have finished writing the log
message if you don't include a \n at the end of the message?
What is the behavior of Rsyslog? It deletes logs and starts again with
other logs?
When we have few logs, can we not add a timeout when no logs coming? In
this case, we assumed that the message is complete.
I tested by manually injecting the logs but what seems strange to me
when I did a "tail -f" on the file, the cursor appears well positioned:
\n=WARNING REPORT==== 00-Dec-0000::14:41:00 ===
closing AMQP connection <0.31217.95> (X.X.X.X:54313 -> X.X.X.X:5672):
connection_closed_abruptly\n
not
=WARNING REPORT==== 00-Dec-0000::14:41:00 ===
closing AMQP connection <0.31217.95> (X.X.X.X:54313 -> X.X.X.X:5672):
connection_closed_abruptly\n\n
What is strange, I have logs which are sometimes transferred when
Rsyslog is in daemon mode.
I have the same problem with logs ElasticSearch with ReadMode 2. Here is
the format "[%d{ISO8601}][%-5p][%-25c] %m%n" and I also lose the logs.
If you have a moment, can you see if you can reproduce the problem on
your side?
Best regards,
--
Dle
David Lang
On Thu, 3 Apr 2014, DuyLong Le wrote:
Hello,
I come to you about my problem unsolved. I use Rsyslog 8.0 to run some
tests.
* In all cases, the examples below do not work. Rsyslog does not
transfer messages.
echo -e "=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly" >>
/var/log/rabbitmq/rabbit\@plop.log (normal, no blank line)
echo -e "\n=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly" >>
/var/log/rabbitmq/rabbit\@plop.log (blank line exist)
Rsyslog seems detected the modification but does not go far in the
treatment :
############
# Receive a new event...
8912.800827607:7f19e2183700: DDDD: imfile event notification: rd
16[0], wd (3, mask 00000002, cookie 0000, len 0)
8912.800835413:7f19e2183700: watch was MODIFID
8912.800838865:7f19e2183700: DDDD: imfile: wd 3 got file 0, dir -1
8912.800853129:7f19e2183700: strm 0x7f19dfc14300: file 7 read 156 bytes
8912.800864495:7f19e2183700: strm 0x7f19dfc14300: file 7 read 0 bytes
8912.800871360:7f19e2183700: stream checking for file change on
'/var/log/rabbitmq/[email protected]', inode 30007/30007
# Wait new event...
############
* I add a "\n" to the end and everything seems to work with the
previous examples.
echo -e "=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly\n" >>
/var/log/rabbitmq/rabbit\@plop.log
echo -e "\n=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly\n" >>
/var/log/rabbitmq/rabbit\@plop.log
Do you have a solution because I have the same problem with others
applications ? I tested with the PollingInterval but without result
Best regards,
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
