On Mon, Nov 9, 2015 at 1:40 PM, Peter Portante <[email protected]> wrote:
> > > On Mon, Nov 9, 2015 at 10:08 AM, Rainer Gerhards <[email protected] > > wrote: > >> can you post your *complete* debug log pls >> > > See if this works to access the logs: > https://drive.google.com/file/d/0B5bj4bjotonNaGhmQ1A1QnU2OU0/view?usp=sharing > > Also, I could only "kill -KILL <pid>" to get this service to stop. > > Thanks! > FWIW, I filed https://github.com/rsyslog/rsyslog/issues/593 for this issue. -peter > > -peter > > > >> Rainer >> >> 2015-11-09 16:07 GMT+01:00 Peter Portante <[email protected]>: >> > On Mon, Nov 9, 2015 at 10:04 AM, David Lang <[email protected]> wrote: >> > >> >> On Mon, 9 Nov 2015, Peter Portante wrote: >> >> >> >> >> >>> On Mon, Nov 9, 2015 at 9:51 AM, David Lang <[email protected]> wrote: >> >>> >> >>> On Mon, 9 Nov 2015, Peter Portante wrote: >> >>>> >> >>>> On Mon, Nov 9, 2015 at 3:27 AM, David Lang <[email protected]> wrote: >> >>>> >> >>>>> >> >>>>> are you sure you have the modules installed? does rsyslogd -N2 give >> any >> >>>>> >> >>>>>> errors? >> >>>>>> >> >>>>>> >> >>>>>> I am fairly sure I have the modules installed. Running >> >>>>> "/usr/sbin/rsyslogd >> >>>>> -N2" does not appear to report any errors. >> >>>>> >> >>>>> I ran my rsyslogd under debug mode, and see one debug message from >> >>>>> mmjsonparse talking about a message not finding the cookie, and >> then I >> >>>>> never see that message again. The debug output shows the module >> loaded, >> >>>>> and its version being 8.14.0, but when it encounters a message that >> is >> >>>>> not >> >>>>> CEE it seems to stop entirely (working on understanding the debug >> log >> >>>>> output, probably missing something). >> >>>>> >> >>>>> >> >>>> if the message isn't formatted as @cee:{jsondata} mmjsonparse won't >> be >> >>>> able to handle it. no other whitespace allowed and it must be lower >> case. >> >>>> >> >>>> >> >>> Yes, when records are formatted that way, mmjsonparse handles it as >> >>> expected. >> >>> >> >>> >> >>> >> >>>> but this should be on a per-message basis, if one message doesn't >> match >> >>>> it >> >>>> won't be processed, but the next message is looked at as if the >> first had >> >>>> never existed. >> >>>> >> >>> >> >>> >> >>> It seems that as soon as it sees one message that is not formatted >> >>> properly, it stops processing entirely, and the action queue for that >> just >> >>> builds up (if I read the debug output correctly). >> >>> >> >> >> >> If that's the case it's a new bug, it didn't work that way in the past. >> > >> > >> > Could it be related to this change? >> > >> > >> https://github.com/rsyslog/rsyslog/commit/2ef5dd47395ea3758f408cbbfa3ef37dd33ab615 >> > >> > >> >> >> >> >> >> David Lang >> >> _______________________________________________ >> >> rsyslog mailing list >> >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> >> http://www.rsyslog.com/professional-services/ >> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad >> >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> >> DON'T LIKE THAT. >> >> >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> you DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
