Sent from phone, thus brief. Am 03.03.2015 20:02 schrieb "David Lang" <[email protected]>: > > On Tue, 3 Mar 2015, Thomas D. wrote: > >> Rainer wrote: >>>>> >>>>> side-activity: could you please apply this patch and see if the test now >>>>> succeeds on your system with the new tools: >>>>> >>>>> >>>> https://github.com/rgerhards/rsyslog/commit/de082e425f3f6d430eb136a2fb230d58b7e9580e >>>> >>>> Failing: >>>> >>>> >>>> FAIL: imuxsock_logger.sh >>>> ======================== >>>> >>>> [imuxsock_logger.sh]: test imuxsock in rfc3164 mode >>>> rsyslog.pid exists, trying to shut down rsyslogd process 29789. >>>> rsyslogd started with pid 29974 >>>> imdiag[13500]: mainqueue empty >>>> rsyslog.out.log ./resultdata/imuxsock_logger.log differ: byte 2, line 1 >>>> imuxsock_logger.sh failed >>>> contents of rsyslog.out.log: >>>> " root: test" >>>> FAIL imuxsock_logger.sh (exit status: 1) >>>> >>> >>> interesting... Could you record the raw message form me? Or a debug log? >>> For debug log, you can simply edit ./tests/diag.sh, search for DEBUG >>> variables on the first page (you'll know what I mean when you look at that >>> page). >> >> >> Please see the attached debug log. > > > Ok, if I'm reading the log correctly, here is the line that shows the message > delivered to rsyslog > > 6630.247443933:main Q:Reg/w0 : processBATCH: next msg 0: <5>Mar 3 19:17:10 > vm-gentoo-x64 root: test >
This is a misunderstanding : the testbench test patch makes logger use rfc3164, so that the "normal" test can be used. As I wrote, I work on changes to imzxsock to support multiple formats. But we still need the test for the previous standard format - ESPECIALLY As u am not sure if the format change to the local log socket was in tentional (as I wrote ). However, this is rfc3164 but not what was spoken before on the log socket. The Hostname is normally not included and this is why the test fails. Is there any option in new logger to use the format that was previously used? Rainer > This is showing the message being pulled from the main queue, not the raw log arriving via uxsock, so it's possible it's already been manipulated > > according to RFC5424, the header is PRI VERSION SP TIMESTAMP SP HOSTNAME > > so if this is the raw log, this is not quite valid RFC5424, it would have " 1 " between the > and Mar (I was misremembering that the version was before the pri) > > In the test config, there should be a template that it uses to generate this output. Can you try changing it to RSYSLOG_DebugFormat just to be sure that we are seeing the raw log? this will put a lot of other info in the rsyslog.out.log file, but will include both the parsed and the raw log. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
