Hi,
Hi,
How is rsyslog supposed to know that you have finished writing the log
message if you don't include a \n at the end of the message?
What is the behavior of Rsyslog? It deletes logs and starts again with
other logs?
no, I believe that it just combines everything that arrives between
newlines into one log.
I'm not sure because when I have logs on centralized server, I do not
see the previous logs. That is why I ask you. If I correct this problem,
it is already great :)
When we have few logs, can we not add a timeout when no logs coming?
In this case, we assumed that the message is complete.
well, only having a few logs is not the normal use of rsyslog :-) what
sort of timeout are you thinking of?
"few" compared to a centralized server or firewall logs ;)
I tested by manually injecting the logs but what seems strange to me
when I did a "tail -f" on the file, the cursor appears well positioned:
\n=WARNING REPORT==== 00-Dec-0000::14:41:00 ===
closing AMQP connection <0.31217.95> (X.X.X.X:54313 -> X.X.X.X:5672):
connection_closed_abruptly\n
not
=WARNING REPORT==== 00-Dec-0000::14:41:00 ===
closing AMQP connection <0.31217.95> (X.X.X.X:54313 -> X.X.X.X:5672):
connection_closed_abruptly\n\n
What is strange, I have logs which are sometimes transferred when
Rsyslog is in daemon mode.
I have the same problem with logs ElasticSearch with ReadMode 2. Here
is the format "[%d{ISO8601}][%-5p][%-25c] %m%n" and I also lose the logs.
If you have a moment, can you see if you can reproduce the problem on
your side?
readmode2 only affects reading from files. In that case a new lines
isn't the end of a log message, and rsyslog can only tell if it's really
the end when the next character after the newline arrives. This means
that rsyslog may not see the last message that has been written right away.
I agree for new logs but I do not understand why previous logs that are
ignored while new logs are written (A line is present between old and
new messages).
The problem with a timeout is that we don't know the system scheduler,
what happens if the process writing the log isn't scheduled for a while
because of system load?
Yes it is not obvious... but it's better than waiting when there is no
written logs.
Best regards,
--
Dle
David Lang
Best regards,
--
Dle
David Lang
On Thu, 3 Apr 2014, DuyLong Le wrote:
Hello,
I come to you about my problem unsolved. I use Rsyslog 8.0 to run some
tests.
* In all cases, the examples below do not work. Rsyslog does not
transfer messages.
echo -e "=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly" >>
/var/log/rabbitmq/rabbit\@plop.log (normal, no blank line)
echo -e "\n=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly" >>
/var/log/rabbitmq/rabbit\@plop.log (blank line exist)
Rsyslog seems detected the modification but does not go far in the
treatment :
############
# Receive a new event...
8912.800827607:7f19e2183700: DDDD: imfile event notification: rd
16[0], wd (3, mask 00000002, cookie 0000, len 0)
8912.800835413:7f19e2183700: watch was MODIFID
8912.800838865:7f19e2183700: DDDD: imfile: wd 3 got file 0, dir -1
8912.800853129:7f19e2183700: strm 0x7f19dfc14300: file 7 read 156 bytes
8912.800864495:7f19e2183700: strm 0x7f19dfc14300: file 7 read 0 bytes
8912.800871360:7f19e2183700: stream checking for file change on
'/var/log/rabbitmq/[email protected]', inode 30007/30007
# Wait new event...
############
* I add a "\n" to the end and everything seems to work with the
previous examples.
echo -e "=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly\n" >>
/var/log/rabbitmq/rabbit\@plop.log
echo -e "\n=WARNING REPORT==== XX-XXX-XXXX::14:41:00 ===\nclosing AMQP
connection <0.31217.95> (X.X.X.X:54313 ->
X.X.X.X:5672):\nconnection_closed_abruptly\n" >>
/var/log/rabbitmq/rabbit\@plop.log
Do you have a solution because I have the same problem with others
applications ? I tested with the PollingInterval but without result
Best regards,
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
