On Mon, Nov 9, 2015 at 10:08 AM, Rainer Gerhards <[email protected]> wrote:
> can you post your *complete* debug log pls > See if this works to access the logs: https://drive.google.com/file/d/0B5bj4bjotonNaGhmQ1A1QnU2OU0/view?usp=sharing Also, I could only "kill -KILL <pid>" to get this service to stop. Thanks! -peter > Rainer > > 2015-11-09 16:07 GMT+01:00 Peter Portante <[email protected]>: > > On Mon, Nov 9, 2015 at 10:04 AM, David Lang <[email protected]> wrote: > > > >> On Mon, 9 Nov 2015, Peter Portante wrote: > >> > >> > >>> On Mon, Nov 9, 2015 at 9:51 AM, David Lang <[email protected]> wrote: > >>> > >>> On Mon, 9 Nov 2015, Peter Portante wrote: > >>>> > >>>> On Mon, Nov 9, 2015 at 3:27 AM, David Lang <[email protected]> wrote: > >>>> > >>>>> > >>>>> are you sure you have the modules installed? does rsyslogd -N2 give > any > >>>>> > >>>>>> errors? > >>>>>> > >>>>>> > >>>>>> I am fairly sure I have the modules installed. Running > >>>>> "/usr/sbin/rsyslogd > >>>>> -N2" does not appear to report any errors. > >>>>> > >>>>> I ran my rsyslogd under debug mode, and see one debug message from > >>>>> mmjsonparse talking about a message not finding the cookie, and then > I > >>>>> never see that message again. The debug output shows the module > loaded, > >>>>> and its version being 8.14.0, but when it encounters a message that > is > >>>>> not > >>>>> CEE it seems to stop entirely (working on understanding the debug log > >>>>> output, probably missing something). > >>>>> > >>>>> > >>>> if the message isn't formatted as @cee:{jsondata} mmjsonparse won't be > >>>> able to handle it. no other whitespace allowed and it must be lower > case. > >>>> > >>>> > >>> Yes, when records are formatted that way, mmjsonparse handles it as > >>> expected. > >>> > >>> > >>> > >>>> but this should be on a per-message basis, if one message doesn't > match > >>>> it > >>>> won't be processed, but the next message is looked at as if the first > had > >>>> never existed. > >>>> > >>> > >>> > >>> It seems that as soon as it sees one message that is not formatted > >>> properly, it stops processing entirely, and the action queue for that > just > >>> builds up (if I read the debug output correctly). > >>> > >> > >> If that's the case it's a new bug, it didn't work that way in the past. > > > > > > Could it be related to this change? > > > > > https://github.com/rsyslog/rsyslog/commit/2ef5dd47395ea3758f408cbbfa3ef37dd33ab615 > > > > > >> > >> > >> David Lang > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
