On 2015-02-10 08:37 AM, Rainer Gerhards wrote:
> 2015-02-10 16:32 GMT+01:00 James Lay <[email protected] [4]>: > >> Help....just made the switch and seeing a ton of these types of errors: >> >> rsyslogd: Framing Error in received TCP message: delimiter is not SP but has ASCII value 46. > > this sounds like a problem with the sender. Rsyslog is seing invalid protocol handling, more precisely a framing error. ASCII code 46 (the dot) is seen where either < or an integer number must be. > If that's an option, you could capture a tcp session and post the capture file so that I can have a look with wireshark. > Rainer > >> Not even sure where to start to look at this. Thank you. >> >> James >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog [1] >> http://www.rsyslog.com/professional-services/ [2] >> What's up with rsyslog? Follow https://twitter.com/rgerhards [3] >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. Yes...these messages are from a proxy device which is just connecting via tcp to port 514...I am fairly certain that these aren't protocol compliant with things like: 192.168.1.1 - - TCP.... 192.168.1.1 DOMAINname .... 192.168.1.1 - 192.168.1.2 .... A lot of these messages contain funky characters. Is there a way I can tell rsyslog to just log and ignore protocol? Thank you. James Links: ------ [1] http://lists.adiscon.net/mailman/listinfo/rsyslog [2] http://www.rsyslog.com/professional-services/ [3] https://twitter.com/rgerhards [4] mailto:[email protected] _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
