Honestly, I will have to post my config off list, nor do I use a compiled version of rsyslog and instead use the RPM packages available here for CentOS/RHEL 6.4
I'll do my best to get debug information out but I can assure you that my messages were coming in fragmented on IMPTCP on rsyslog 8.2.1 and are no longer doing so when I move globals above modules... For reference here was my broken config _STRUCTURES_ for each of my conf file types: (Each number is a .conf file under /etc/rsyslog.d) 00 - pstats 01 - I/O Module Definitions 02 - Template Definitions 03 - Main Queue Definitions 06 - Global() definitions 70 - Ruleset A 71 - Ruleset B 90 - Local Output Configurations 99 - Input Definitions for IM UDP/IMP TCP modules Note that when I use the above config layout, the 01 I/O modules do not take the MaxMessageSize parameters set in 06, it was not until I COMBINED 06 with 00 (thus loading the global ABOVE the I/O modules) that my messages stopped fragmenting. I'll do my best to get some debug logs as well but unfortunately the servers this issue was discovered on cannot readily be started/stopped at will. On Fri, May 30, 2014 at 5:07 AM, Rainer Gerhards <[email protected]> wrote: > On Wed, May 28, 2014 at 11:06 PM, Nick Syslog <[email protected]> > wrote: > > > Just FYI, > > > > I pushed global() above my modules and no longer see fragmentation on > > messages through imPtcp so it would appear the issue from prior legacy > > versions does still exist (I load my configurations from > > /etc/rsyslog.d/*.conf and label them in sequence 00, 01, etc.) > > > > Previously my configuration had global() loading AFTER the module > > definitions, after placing the configuration for global above the module > > configurations I stopped seeing message fragmentation on TCP messages. > > > > > I tried to reproduce this with imptcp and imudp, but it always works for me > (but keep in mind that I still have not received your config, so there may > be some other issues). > > I crafted a patch that provides some more insight. It works with 8.2.1. > Find it here: > > > https://github.com/rsyslog/rsyslog/commit/01ab68f4e5d4e6f6b203413446f0e3f9cbc082d0 > > Please apply the patch and provide a debug log. Startup is sufficient. This > hopefully gets me some insight of what's going on. > > Thanks, > Rainer > > > > > On Wed, May 28, 2014 at 9:31 AM, Nick Syslog <[email protected]> > > wrote: > > > > > 8.2.1 presently > > > > > > > > > On Wed, May 28, 2014 at 9:24 AM, Rainer Gerhards < > > [email protected] > > > > wrote: > > > > > >> quick question: is this v8.2.2? > > >> > > >> > > >> On Wed, May 28, 2014 at 6:23 PM, Rainer Gerhards > > >> <[email protected]>wrote: > > >> > > >> > > > >> > On Wed, May 28, 2014 at 6:20 PM, Nick Syslog < > [email protected] > > >> >wrote: > > >> > > > >> >> Note: I use exclusively IMPTCP and do not load IMTCP at all > > >> >> > > >> >> > > >> > mmhhh.. can you pls post your conf. I'll try to repo (note that > > tomorrow > > >> > is a public holiday over here and I will only be shortly in the > office > > >> on > > >> > friday, so it may take until next week if some support tasks gets in > > my > > >> > way). > > >> > > > >> > Rainer > > >> > > > >> >> > > >> >> On Wed, May 28, 2014 at 8:42 AM, Rainer Gerhards > > >> >> <[email protected]>wrote: > > >> >> > > >> >> > On Tue, May 27, 2014 at 10:03 PM, Nick Syslog < > > >> [email protected] > > >> >> > >wrote: > > >> >> > > > >> >> > > I'm seeing cases where many of my large TCP events are now > coming > > >> in > > >> >> > > malformed after moving my MaxMessageSize parameters into the > > >> global() > > >> >> > > configuration stanza and was digging through the net to find > that > > >> >> people > > >> >> > > were remediating the issue by placing MaxMessageSize prior to > the > > >> >> module > > >> >> > > load for IMTCP/IMUDP > > >> >> > > > > >> >> > > Is that still the case and should my global() definition reside > > >> above > > >> >> the > > >> >> > > module definitions? > > >> >> > > > > >> >> > > > >> >> > yes, there is a bug in imtcp. Note that imptcp and imudp work > > >> correctly. > > >> >> > I'll look into fixing it. > > >> >> > > > >> >> > Thanks, > > >> >> > Rainer > > >> >> > > > >> >> > > _______________________________________________ > > >> >> > > rsyslog mailing list > > >> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> >> > > http://www.rsyslog.com/professional-services/ > > >> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED > by a > > >> >> myriad > > >> >> > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > > if > > >> you > > >> >> > > DON'T LIKE THAT. > > >> >> > > > > >> >> > _______________________________________________ > > >> >> > rsyslog mailing list > > >> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> >> > http://www.rsyslog.com/professional-services/ > > >> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > >> myriad > > >> >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if > > >> you > > >> >> > DON'T LIKE THAT. > > >> >> > > > >> >> _______________________________________________ > > >> >> rsyslog mailing list > > >> >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> >> http://www.rsyslog.com/professional-services/ > > >> >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > >> myriad > > >> >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > > you > > >> >> DON'T LIKE THAT. > > >> >> > > >> > > > >> > > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com/professional-services/ > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > >> DON'T LIKE THAT. > > >> > > > > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
