could you write a log with the format RSYSLOG_DebugFormat? that will show the
raw message that arrives.
Also, when you say the data in the file is missing the closing }, is there any
chance that it's just buffered and not written to disk yet? or are there other
things in the log after this?
David Lang
On Mon, 2 Jun 2014, Duarte Silva wrote:
Date: Mon, 02 Jun 2014 16:22:29 +0100
From: Duarte Silva <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] Problem with rsyslog deleating
Hi,
when sending JSON formated data to rsyslog, the closing "}" character in the
last line of the sent data isn't written into file. In tcpdump I can clearly
see the full message arriving:
# tcpdump -A -n -vvv -s2048 -i eth0 "tcp port 514"
(...)
=.2.....<164>appliance-892.alert: {
"alert": {
"action": "notified",
"explanation": "something"
},
"id": "892",
"occurred": "2014-06-02T15:00:24Z",
},
"appliance": "appliance",
"product": "product",
"version": "version"
}
.
But when rsyslog writes the message in the file, the output is:
# tail -n 50 /var/log/test.log
(...)
{
"alert": {
"action": "notified",
"explanation": "something"
},
"id": "892",
"occurred": "2014-06-02T15:00:24Z",
},
"appliance": "appliance",
"product": "product",
"version": "version"
The configuration is as follows:
# cat /etc/rsyslog.d/test.conf
$template msgonlytemplate,"%msg%\n"
if $fromhost-ip == '1.1.1.1' then /var/log/test.log;msgonlytemplate
& ~
I'm currently running rsyslog-5.8.10-8.el6.x86_64. Any help will be
appreciated.
Thanks in advance,
Duarte Silva
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
