can you post your *complete* debug log pls Rainer
2015-11-09 16:07 GMT+01:00 Peter Portante <[email protected]>: > On Mon, Nov 9, 2015 at 10:04 AM, David Lang <[email protected]> wrote: > >> On Mon, 9 Nov 2015, Peter Portante wrote: >> >> >>> On Mon, Nov 9, 2015 at 9:51 AM, David Lang <[email protected]> wrote: >>> >>> On Mon, 9 Nov 2015, Peter Portante wrote: >>>> >>>> On Mon, Nov 9, 2015 at 3:27 AM, David Lang <[email protected]> wrote: >>>> >>>>> >>>>> are you sure you have the modules installed? does rsyslogd -N2 give any >>>>> >>>>>> errors? >>>>>> >>>>>> >>>>>> I am fairly sure I have the modules installed. Running >>>>> "/usr/sbin/rsyslogd >>>>> -N2" does not appear to report any errors. >>>>> >>>>> I ran my rsyslogd under debug mode, and see one debug message from >>>>> mmjsonparse talking about a message not finding the cookie, and then I >>>>> never see that message again. The debug output shows the module loaded, >>>>> and its version being 8.14.0, but when it encounters a message that is >>>>> not >>>>> CEE it seems to stop entirely (working on understanding the debug log >>>>> output, probably missing something). >>>>> >>>>> >>>> if the message isn't formatted as @cee:{jsondata} mmjsonparse won't be >>>> able to handle it. no other whitespace allowed and it must be lower case. >>>> >>>> >>> Yes, when records are formatted that way, mmjsonparse handles it as >>> expected. >>> >>> >>> >>>> but this should be on a per-message basis, if one message doesn't match >>>> it >>>> won't be processed, but the next message is looked at as if the first had >>>> never existed. >>>> >>> >>> >>> It seems that as soon as it sees one message that is not formatted >>> properly, it stops processing entirely, and the action queue for that just >>> builds up (if I read the debug output correctly). >>> >> >> If that's the case it's a new bug, it didn't work that way in the past. > > > Could it be related to this change? > > https://github.com/rsyslog/rsyslog/commit/2ef5dd47395ea3758f408cbbfa3ef37dd33ab615 > > >> >> >> David Lang >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
