On Tuesday 03 June 2014 13:18:28 Rainer Gerhards wrote:
> On Tue, Jun 3, 2014 at 1:01 PM, Duarte Silva <[email protected]>
>
> wrote:
> > Hi David,
> >
> > thanks for the tip. I can now understand what Rsyslog is doing when it
> > receives the data :)
> >
> > Since the appliance is sending the JSON in a multi-line format, the last
> > line
> > isn't being interpreted as the message, but rather it's being interpreted
> > as
> > all the other fields.
> >
> > Since I can't modify the way the appliance sends the logs, is there a way
> > in
> > Rsyslog to get around this?
>
> Which protocol is used? Can you post a sample of the data **as seen on the
> wire**?
Quoting:
> > > In tcpdump I clearly see the full message arriving:
> > >
> > > # tcpdump -A -n -vvv -s2048 -i eth0 "tcp port 514"
> > > (...)
> > > =.2.....<164>appliance-892.alert: {
> > >
> > > "alert": {
> > >
> > > "action": "notified",
> > > "explanation": "something"
> > > },
> > > "id": "892",
> > > "occurred": "2014-06-02T15:00:24Z",
> > >
> > > },
> > > "appliance": "appliance",
> > > "product": "product",
> > > "version": "version"
> > >
> > > }
> > > .
> > >
Cheers,
Duarte
>
> Rainer
>
> > Cheers,
> > Duarte
> >
> > On Monday 02 June 2014 10:56:51 David Lang wrote:
> > > could you write a log with the format RSYSLOG_DebugFormat? that will
> > > show
> > > the raw message that arrives.
> > >
> > > Also, when you say the data in the file is missing the closing }, is
> >
> > there
> >
> > > any chance that it's just buffered and not written to disk yet? or are
> > > there other things in the log after this?
> > >
> > > David Lang
> > >
> > > On Mon, 2 Jun 2014, Duarte Silva wrote:
> > > > Date: Mon, 02 Jun 2014 16:22:29 +0100
> > > > From: Duarte Silva <[email protected]>
> > > > Reply-To: rsyslog-users <[email protected]>
> > > > To: [email protected]
> > > > Subject: [rsyslog] Problem with rsyslog deleating
> > > >
> > > > Hi,
> > > >
> > > > when sending JSON formated data to rsyslog, the closing "}" character
> >
> > in
> >
> > > > the last line of the sent data isn't written into file. In tcpdump I
> >
> > can
> >
> > > > clearly see the full message arriving:
> > > >
> > > > # tcpdump -A -n -vvv -s2048 -i eth0 "tcp port 514"
> > > > (...)
> > > > =.2.....<164>appliance-892.alert: {
> > > >
> > > > "alert": {
> > > >
> > > > "action": "notified",
> > > > "explanation": "something"
> > > > },
> > > > "id": "892",
> > > > "occurred": "2014-06-02T15:00:24Z",
> > > >
> > > > },
> > > > "appliance": "appliance",
> > > > "product": "product",
> > > > "version": "version"
> > > >
> > > > }
> > > > .
> > > >
> > > > But when rsyslog writes the message in the file, the output is:
> > > >
> > > > # tail -n 50 /var/log/test.log
> > > > (...)
> > > > {
> > > >
> > > > "alert": {
> > > >
> > > > "action": "notified",
> > > > "explanation": "something"
> > > > },
> > > > "id": "892",
> > > > "occurred": "2014-06-02T15:00:24Z",
> > > >
> > > > },
> > > > "appliance": "appliance",
> > > > "product": "product",
> > > > "version": "version"
> > > >
> > > > The configuration is as follows:
> > > >
> > > > # cat /etc/rsyslog.d/test.conf
> > > >
> > > > $template msgonlytemplate,"%msg%\n"
> > > >
> > > > if $fromhost-ip == '1.1.1.1' then /var/log/test.log;msgonlytemplate
> > > > & ~
> > > >
> > > >
> > > > I'm currently running rsyslog-5.8.10-8.el6.x86_64. Any help will be
> > > > appreciated.
> > > >
> > > > Thanks in advance,
> > > > Duarte Silva
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >
> > myriad
> >
> > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> > > > DON'T LIKE THAT.
> > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> >
> > of
> >
> > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> > > DON'T
> > > LIKE THAT.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> > DON'T LIKE THAT.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
