This is captured on the client? I need the server side. If it is on the server, why is the input imuxsock?
Sent from phone, thus brief. Am 23.04.2014 22:19 schrieb "Brian Huntington" <[email protected] >: > Hello Rainer, thanks for your online video tutorials. I found them very > useful. > > If my template violates the format, I'm willing to change it. My only > requirement is that I'm not prepending rsyslog property values to the log > lines. If preferable, I'd like to send the data exactly the same as it's > generated by the application (Apache) > > I turned on the receiver's debug, and these are the results: > > 1) When my client configuration reads: > local3.* <IP>:514 > all configured input file logging is sent to the log server. The debugger > logs no new data > > 2) When my client configuration reads: > $template msgOnlyTemplate,"%syslogtag%%msg%\n" > if $syslogfacility-text == 'local3' then @156.36.38.61:514;msgOnlyTemplate > & ~ > no configured input file logging is sent to the log server. The debugger > records the following: > > inputname: rsyslogd rawmsg: ' [origin software="rsyslogd" > swVersion="5.10.1" > x-pid="17085" x-info="http://www.rsyslog.com";] start' > > Debug line with all properties: > FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>', > PRI: 15, > syslogtag 'auditmanager:', programname: 'auditmanager', APP-NAME: > 'auditmanager', PROCID: '-', MSGID: '-', > TIMESTAMP: 'Apr 23 14:56:22', STRUCTURED-DATA: '-', > msg: ' Received wakeup signal before sleep finished' > escaped msg: ' Received wakeup signal before sleep finished' > inputname: imuxsock rawmsg: '<15>Apr 23 14:56:22 auditmanager: Received > wakeup signal before sleep finished' > > Debug line with all properties: > FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>', > PRI: 15, > syslogtag 'auditmanager:', programname: 'auditmanager', APP-NAME: > 'auditmanager', PROCID: '-', MSGID: '-', > TIMESTAMP: 'Apr 23 14:56:24', STRUCTURED-DATA: '-', > msg: ' last message repeated 2 times' > escaped msg: ' last message repeated 2 times' > inputname: imuxsock rawmsg: '<15>Apr 23 14:56:22 auditmanager: last message > repeated 2 times' > > [truncated] > > Debug line with all properties: > FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>', > PRI: 31, > syslogtag '.vasac_helper[17173]:', programname: '.vasac_helper', APP-NAME: > '.vasac_helper', PROCID: '17173', MSGID: '-', > TIMESTAMP: 'Apr 23 14:56:35', STRUCTURED-DATA: '-', > msg: ' Unable to set daemon API context to default to memory ccache in > _local_vas_init, Error was Invalid VAS context, no available error message' > escaped msg: ' Unable to set daemon API context to default to memory ccache > in _local_vas_init, Error was Invalid VAS context, no available error > message' > inputname: imuxsock rawmsg: '<31>Apr 23 14:56:35 .vasac_helper[17173]: > Unable to set daemon API context to default to memory ccache in > _local_vas_init, Error was Invalid VAS context, no available error message' > > followed by > msg: ' Received wakeup signal before sleep finished' > msg: ' last message repeated 2 times' > > several times in a row > > > > -- > View this message in context: > http://rsyslog-users.1305293.n2.nabble.com/imfile-templates-tp7585270p7585274.html > Sent from the rsyslog-users mailing list archive at Nabble.com. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
