Hi We ran into this issue first time with rsyslog 7.2.6. With 'RepeatedMsgReduction on', we saw the syslog printed ended up with wrong timestamp. Please see the timestamp in lines 2,3,4 below. The timestamp in line 4 should be 2018 Oct 22 11:20:25.
2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:25 glc254 Aaa: last message repeated 6 times 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command01'. 2018 Oct 22 11:20:25 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. Could this be related to https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1392317 or http://bugzilla.adiscon.com/show_bug.cgi?id=527 As we are moving to latest rsyslog, we still have quite a few install base with 7.2.6. Appreciate if anyone could let me know if this a known bug and is fixed in 8.x. Thank you. Larger output around above messages below: 2018 Oct 22 11:20:00 glc254 Aaa: last message repeated 6 times 2018 Oct 22 11:20:00 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command01'. 2018 Oct 22 11:20:00 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:23 glc254 Aaa: last message repeated 43 times 2018 Oct 22 11:20:23 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:23 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:23 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:24 glc254 Aaa: last message repeated 3 times 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command01'. 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:25 glc254 Aaa: last message repeated 6 times 2018 Oct 22 11:20:24 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command01'. 2018 Oct 22 11:20:25 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:27 glc254 Aaa: last message repeated 3 times 2018 Oct 22 11:20:27 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:28 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. 2018 Oct 22 11:20:28 glc254 Aaa: last message repeated 2 times 2018 Oct 22 11:20:28 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'exec'. 2018 Oct 22 11:20:28 glc254 Aaa: %AAA-4-ACCT: Accounting method 'group tacacs+' is currently unavailable; falling back to next method for action 'command15'. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
