Hi Emmanuel, Look into tcp_framing on omfwd. That's my best guess as I was seeing the same thing in the past.
https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive| Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com > -----Original Message----- > From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of > Emmanuel Seyman > Sent: Tuesday, November 6, 2018 10:27 AM > To: rsyslog@lists.adiscon.com > Subject: [rsyslog] %HOSTNAME% corruption > > > I'm using rsyslog as a central syslog server and storing messages from > each syslog client in its own directory (using logs/rsyslog/%HOSTNAME% > in a template). Messages are sent to a rsyslog relay before then being > sent to the central server. > > I'm now seeing directories that cannot possibly be hostnames being created: > > * logs/rsyslog/mysqlhotcopy > * logs/rsyslog/VERSION > * logs/rsyslog/GET > * logs/rsyslog/OPTIONS > * logs/rsyslog/r > > and so on and so on... > > These look like the syslog message is being corrupted during the transfer > with > part of the message taking the place of the hostname but virtually all of the > syslog transfers are done via TCP, which I thought would prevent this. > > Is this a known problem? Did I misconfigure rsyslog somehow? > > Thanks for any help you can give. > > Emmanuel > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
