On Tue, Jun 3, 2014 at 1:01 PM, Duarte Silva <[email protected]> wrote:
> Hi David, > > thanks for the tip. I can now understand what Rsyslog is doing when it > receives the data :) > > Since the appliance is sending the JSON in a multi-line format, the last > line > isn't being interpreted as the message, but rather it's being interpreted > as > all the other fields. > > Since I can't modify the way the appliance sends the logs, is there a way > in > Rsyslog to get around this? > > Which protocol is used? Can you post a sample of the data **as seen on the wire**? Rainer > Cheers, > Duarte > > On Monday 02 June 2014 10:56:51 David Lang wrote: > > could you write a log with the format RSYSLOG_DebugFormat? that will show > > the raw message that arrives. > > > > Also, when you say the data in the file is missing the closing }, is > there > > any chance that it's just buffered and not written to disk yet? or are > > there other things in the log after this? > > > > David Lang > > > > On Mon, 2 Jun 2014, Duarte Silva wrote: > > > Date: Mon, 02 Jun 2014 16:22:29 +0100 > > > From: Duarte Silva <[email protected]> > > > Reply-To: rsyslog-users <[email protected]> > > > To: [email protected] > > > Subject: [rsyslog] Problem with rsyslog deleating > > > > > > Hi, > > > > > > when sending JSON formated data to rsyslog, the closing "}" character > in > > > the last line of the sent data isn't written into file. In tcpdump I > can > > > clearly see the full message arriving: > > > > > > # tcpdump -A -n -vvv -s2048 -i eth0 "tcp port 514" > > > (...) > > > =.2.....<164>appliance-892.alert: { > > > > > > "alert": { > > > > > > "action": "notified", > > > "explanation": "something" > > > }, > > > "id": "892", > > > "occurred": "2014-06-02T15:00:24Z", > > > > > > }, > > > "appliance": "appliance", > > > "product": "product", > > > "version": "version" > > > > > > } > > > . > > > > > > But when rsyslog writes the message in the file, the output is: > > > > > > # tail -n 50 /var/log/test.log > > > (...) > > > { > > > > > > "alert": { > > > > > > "action": "notified", > > > "explanation": "something" > > > }, > > > "id": "892", > > > "occurred": "2014-06-02T15:00:24Z", > > > > > > }, > > > "appliance": "appliance", > > > "product": "product", > > > "version": "version" > > > > > > The configuration is as follows: > > > > > > # cat /etc/rsyslog.d/test.conf > > > > > > $template msgonlytemplate,"%msg%\n" > > > > > > if $fromhost-ip == '1.1.1.1' then /var/log/test.log;msgonlytemplate > > > & ~ > > > > > > > > > I'm currently running rsyslog-5.8.10-8.el6.x86_64. Any help will be > > > appreciated. > > > > > > Thanks in advance, > > > Duarte Silva > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
