I have to wait for each version to bubble up through the lower testing environments unless there's a compelling reason to pull it forward. It takes 2 months to make it to production normally.
Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive| Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com > -----Original Message----- > From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of Rainer > Gerhards > Sent: Friday, March 22, 2019 9:59 AM > To: rsyslog-users <rsyslog@lists.adiscon.com> > Subject: Re: [rsyslog] strange receiver directory names for FROMHOST on > imfile long lines > > > > ATTENTION: This email was sent to La-Z-Boy from an > external > source. Be vigilant when opening attachments or clicking links. > > > El vie., 22 mar. 2019 a las 14:40, Scot Kreienkamp > (<scot.kreienk...@la-z-boy.com>) escribió: > > > > Currently 8.40 (RPM), pending upgrade to 8.1901 within the week. > > I would go 8.1903.0, there have been some bug fixes. > > I thought it would be a much older version. So out of my head I have > not real answer now. Need to look at code, but have no time today for > this. > > Rainer > > > > > > Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate > > One La-Z-Boy Drive| Monroe, Michigan 48162 | Office: 734-384-6403 | | > Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com > > > -----Original Message----- > > > From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of > Rainer > > > Gerhards > > > Sent: Friday, March 22, 2019 9:34 AM > > > To: rsyslog-users <rsyslog@lists.adiscon.com> > > > Subject: Re: [rsyslog] strange receiver directory names for FROMHOST on > > > imfile long lines > > > > > > > > > > > > ATTENTION: This email was sent to La-Z-Boy from > > > an > external > > > source. Be vigilant when opening attachments or clicking links. > > > > > > > > > rsyslog version? > > > > > > Rainer > > > > > > El vie., 22 mar. 2019 a las 14:32, Scot Kreienkamp > > > (<scot.kreienk...@la-z-boy.com>) escribió: > > > > > > > > Hi everyone, > > > > > > > > I'm using patterns like this for all of the incoming logs in my central > > > > syslog > > > receiver so that all the logs from each host wind up in a directory named > after > > > the host that's sending the logs. > > > > > > > > template (name="DailyPerHostLogDMA" type="string" > > > string="/opt/syslog/%HOSTNAME%/tomcat/RMSDoormanAdapter- > %$YEAR%- > > > %$MONTH%-%$DAY%") > > > > $MaxMessageSize 8192k > > > > global(workDirectory="/var/spool/rsyslog" preserveFQDN="on" > > > maxMessageSize="8192k") > > > > > > > > > > > > I think the basic problem is that I have a number of remote senders that > are > > > using imfile to read logs that contain single lines that are pages long, > > > I'm > > > assuming they are too long to forward without splitting. The end result > > > is > that I > > > have all kinds of directories created by rsyslog with logs in them that > > > are > not > > > named after servers. Here's a sample: > > > > > > > > [root@monvsyslog syslog]# ll |egrep -iv -e lzb -e mdmza > > > > total 1352 > > > > drwxr-xr-x 4 root root 44 Feb 28 12:55 b.hq > > > > drwxr-xr-x 2 root root 4096 Mar 22 01:30 echo > > > > drwxr-xr-x 2 root root 4096 Mar 22 01:23 GET > > > > drwxr-xr-x 4 root root 44 Feb 28 15:50 hq > > > > drwxr-xr-x 2 root root 4096 Mar 22 01:22 modv6029 > > > > drwxr-xr-x 4 root root 44 Feb 28 13:25 q > > > > drwxr-xr-x 4 root root 44 Feb 28 16:15 zb.hq > > > > > > > > Again, I'm assuming that the receiver is splitting the message, but I > > > > guess > it > > > could be done on the sender as well. I do get notices sometimes on the > > > receiver that it's splitting messages but not often. I've increased the > > > MaxMessageSize on everything in the environment but it doesn't seem to > make > > > any difference. Beyond that I'm not sure what to do to try and resolve > > > this. > > > > > > > > The sender config is inline below: > > > > > > > > #RMSDoormanAdapter forwarder template, so we can add servername > and > > > tag > > > > template (name="DailyPerHostLogDMA" type="string" > > > string="/var/log/tomcat6/RMSDoormanAdapter-%$YEAR%-%$MONTH%- > > > %$DAY%") > > > > template(name="RMS-ForwardDMA" type="list") { > > > > constant(value="<") > > > > property(name="pri") > > > > constant(value=">") > > > > property(name="timestamp" dateFormat="rfc3339") > > > > constant(value=" ") > > > > constant(value="retv6030.na.lzb.hq") > > > > constant(value=" ") > > > > constant(value="RMS-DMA:") > > > > property(name="msg" spifno1stsp="on" ) > > > > property(name="msg") > > > > } > > > > > > > > > > > > #ruleset for local port listener for RMSDoorManAdapter > > > > ruleset(name="RMS-DMA-1516-1531" > > > > queue.filename="Net-1516-1531" > > > > queue.dequeuebatchsize="1024" > > > > queue.discardmark="45000" > > > > queue.DiscardSeverity="0" > > > > queue.maxDiskSpace="1g" > > > > queue.saveOnShutdown="on" > > > > queue.size="50000" > > > > queue.spoolDirectory="/var/spool/rsyslog" > > > > queue.type="LinkedList" > > > > ){ > > > > action( > > > > name="omfile-RMS-ForwardDMA" > > > > type="omfile" > > > > dynafilecachesize="5" > > > > DynaFile="DailyPerHostLogDMA" > > > > template="msgonly-no1sp" > > > > ioBufferSize="64k" > > > > flushOnTXEnd="off" > > > > asyncWriting="on" > > > > dirCreateMode="0755" > > > > ) > > > > action( > > > > name="fwd-monvsyslog-1531-RMS-DMA" > > > > queue.dequeuebatchsize="1024" > > > > queue.discardmark="45000" > > > > queue.DiscardSeverity="0" > > > > queue.maxDiskSpace="1g" > > > > queue.saveOnShutdown="on" > > > > queue.size="50000" > > > > queue.spoolDirectory="/var/spool/rsyslog" > > > > queue.type="LinkedList" > > > > queue.filename="fwd-monvsyslog-1531-RMS-DMA" > > > > type="omfwd" > > > > TCP_Framing="octet-counted" > > > > protocol="tcp" > > > > Target="monvsyslog.na.lzb.hq" > > > > Port="1531" > > > > template="RMS-ForwardDMA" > > > > ) > > > > stop > > > > } > > > > > > > > > > > > I've been banging my head against the wall with this problem for some > time > > > and haven't made any progress. I don't know if I can limit the imfile per > line > > > size or trim imfile input in any way? Or trim the line on the sender to > > > less > than > > > maxmessagesize? Or anything else I can do? Any suggestions would be > > > appreciated. > > > > > > > > Thanks! > > > > > > > > Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate > > > > One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * > > > 7349151444 | * scot.kreienk...@la-z-boy.com<mailto:%7BE-mail%7D> > > > > www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z- > boy.com/> | > > > > facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com > > > > /lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazb > > > oy> | twitter.com/lazboy<https://twitter.com/lazboy> | > > > > youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.yout > > > ube.com/user/lazboy> > > > > > > > > [cid:lzbVertical_hres.jpg] > > > > > > > > > > > > > > > > This message is intended only for the individual or entity to which it > > > > is > > > addressed. It may contain privileged, confidential information which is > exempt > > > from disclosure under applicable laws. If you are not the intended > recipient, > > > you are strictly prohibited from disseminating or distributing this > information > > > (other than to the intended recipient) or copying this information. If > > > you > have > > > received this communication in error, please notify us immediately by e- > mail > > > or by telephone at the above number. Thank you. > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of > > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T > > > LIKE THAT. > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T > > > LIKE THAT. > > > > This message is intended only for the individual or entity to which it is > addressed. It may contain privileged, confidential information which is > exempt > from disclosure under applicable laws. If you are not the intended recipient, > you are strictly prohibited from disseminating or distributing this > information > (other than to the intended recipient) or copying this information. If you > have > received this communication in error, please notify us immediately by e-mail > or by telephone at the above number. Thank you. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
