On Mon, 9 Nov 2015, Peter Portante wrote:
On Mon, Nov 9, 2015 at 9:51 AM, David Lang <[email protected]> wrote:
On Mon, 9 Nov 2015, Peter Portante wrote:
On Mon, Nov 9, 2015 at 3:27 AM, David Lang <[email protected]> wrote:
are you sure you have the modules installed? does rsyslogd -N2 give any
errors?
I am fairly sure I have the modules installed. Running
"/usr/sbin/rsyslogd
-N2" does not appear to report any errors.
I ran my rsyslogd under debug mode, and see one debug message from
mmjsonparse talking about a message not finding the cookie, and then I
never see that message again. The debug output shows the module loaded,
and its version being 8.14.0, but when it encounters a message that is not
CEE it seems to stop entirely (working on understanding the debug log
output, probably missing something).
if the message isn't formatted as @cee:{jsondata} mmjsonparse won't be
able to handle it. no other whitespace allowed and it must be lower case.
Yes, when records are formatted that way, mmjsonparse handles it as
expected.
but this should be on a per-message basis, if one message doesn't match it
won't be processed, but the next message is looked at as if the first had
never existed.
It seems that as soon as it sees one message that is not formatted
properly, it stops processing entirely, and the action queue for that just
builds up (if I read the debug output correctly).
If that's the case it's a new bug, it didn't work that way in the past.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
