Try writing the log message to a file using the same template that you are using
to send it to the database, you may find that there's an embedded newline or
other puncutation in the failing message.
David Lang
On Mon, 19 Nov 2018, Rainer Gerhards
wrote:
Date: Mon, 19 Nov 2018 21:04:52 +0100
From: Rainer Gerhards <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Missing messages in our databases
El lun., 19 nov. 2018 a las 19:47, Mike Schleif
(<[email protected]>) escribió:
Sorry, I didn't notice this earlier :(
On Mon, Nov 19, 2018 at 11:44 AM Rainer Gerhards <[email protected]>
wrote:
> Do you have any rsyslog error messages "in front of" the quoted ones?
> They look like the are second in an error report - but may
> unfortunately be the only ones.
>
> Nothing looks obviously wrong to me.
>
> Rainer
>
Feb 3 02:16:33 hermes rsyslogd[30458]: ommysql: db error (1172): Result
consisted of more than one row [v8.32.0]
Feb 3 02:16:33 hermes rsyslogd[30458]: The error statement was: insert
into SystemEvents (Message, Facility, FromHost, Priority,
DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('Connection
reset by 172.31.128.100 port 39596 [preauth]', 10, 'hermes', 6,
'20180203021157', '20180203021157', 1, 'sshd[17977]:') [v8.32.0 try
http://www.rsyslog.com/e/2218 ]
I admit I do notnow what that means in the context here. More than one
row ... I don't understand why this can happen with an insert
statement. Anyone?
Rainer
Nov 15 11:39:43 hermes rsyslogd[701]: ommysql: db error (1172): Result
consisted of more than one row [v8.39.0]
Nov 15 11:39:43 hermes rsyslogd[701]: The error statement was: insert into
SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime,
ReceivedAt, InfoUnitID, SysLogTag) values ('pam_unix(sshd:session): session
closed for user ms50013', 10, 'hermes', 6, '20181115113943',
'20181115113943', 1, 'sshd[12048]:') [v8.39.0 try
http://www.rsyslog.com/e/2218 ]
_What_ is more than one row?
What can we do about this?
Please, advise. Thank you.
~ Mike
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
