You have two issues happening, but they are both related to the same root cause.
The syslog spec is designed around newline indicating a new log message
in imfile (on a suitably recent version, I'm not sure if 5.8 has it), you can
set readmode to tell it to combine multiple lines into one message. This will
delay delivery of the last message in the file until the next message is written
(otherwise rsyslog can't be sure that there isn't more that's going to be
written as part of the old log message)
http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html
The second problem is that when you send the logs over the network, the default
is to have a newline indicate the end of a log message. There is an option to do
octet framing so that the message can have embedded newlines
http://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html
David Lang
On Wed, 2 Mar 2016, Alex Florescu wrote:
Date: Wed, 2 Mar 2016 00:41:39 +0000
From: Alex Florescu <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] Sending text block to rsyslog srvr prefixes each line
with
date
Hi all,
I have rsyslog (7.4.4, ubuntu) configured to monitor a file and send
messages to a centralized logging server, also running rsyslog (5.8.10, aws
linux).
I have the following rsyslog conf on the client side:
$InputFileName /path/to/log
$InputFileTag tagforlog
$InputFileStateFile log
$InputFileFacility local5
$InputRunFileMonitor
And messages in the log file are logged like this:
[2016-03-02 00:13:14] ERROR: exception '\Exception\NotFoundHttpException'
in /some/file.php:148
Stack trace:
#0 /some/file(369): \RouteCollection->match(Object(\Http\Request))
#1 /some/file(1022): \Router->findRoute(Object(\Http\Request))
[...]
but on the receiving end all lines will be prefixed with a date stamp, like
this:
Mar 2 00:13:21 server1 tagforlog ERROR: exception
'\Exception\NotFoundHttpException' in /some/file.php:148
Mar 2 00:13:21 server1 tagforlog Stack trace:
Mar 2 00:13:21 server1 tagforlog #0 /some/file(369):
\RouteCollection->match(Object(\Http\Request))
Mar 2 00:13:21 server1 tagforlog #1 /some/file(1022):
\Router->findRoute(Object(\Http\Request))
[...]
Is there some option I can use to prevent prefixing subsequent lines in a
block of text?
Regards.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
