On Mon, Nov 9, 2015 at 10:04 AM, David Lang <[email protected]> wrote: > On Mon, 9 Nov 2015, Peter Portante wrote: > > >> On Mon, Nov 9, 2015 at 9:51 AM, David Lang <[email protected]> wrote: >> >> On Mon, 9 Nov 2015, Peter Portante wrote: >>> >>> On Mon, Nov 9, 2015 at 3:27 AM, David Lang <[email protected]> wrote: >>> >>>> >>>> are you sure you have the modules installed? does rsyslogd -N2 give any >>>> >>>>> errors? >>>>> >>>>> >>>>> I am fairly sure I have the modules installed. Running >>>> "/usr/sbin/rsyslogd >>>> -N2" does not appear to report any errors. >>>> >>>> I ran my rsyslogd under debug mode, and see one debug message from >>>> mmjsonparse talking about a message not finding the cookie, and then I >>>> never see that message again. The debug output shows the module loaded, >>>> and its version being 8.14.0, but when it encounters a message that is >>>> not >>>> CEE it seems to stop entirely (working on understanding the debug log >>>> output, probably missing something). >>>> >>>> >>> if the message isn't formatted as @cee:{jsondata} mmjsonparse won't be >>> able to handle it. no other whitespace allowed and it must be lower case. >>> >>> >> Yes, when records are formatted that way, mmjsonparse handles it as >> expected. >> >> >> >>> but this should be on a per-message basis, if one message doesn't match >>> it >>> won't be processed, but the next message is looked at as if the first had >>> never existed. >>> >> >> >> It seems that as soon as it sees one message that is not formatted >> properly, it stops processing entirely, and the action queue for that just >> builds up (if I read the debug output correctly). >> > > If that's the case it's a new bug, it didn't work that way in the past.
Could it be related to this change? https://github.com/rsyslog/rsyslog/commit/2ef5dd47395ea3758f408cbbfa3ef37dd33ab615 > > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
