Re: [rsyslog] I found that many logs vanished on the way of omfwd, so how to check it?

2020-02-12 Thread lxy via rsyslog
I am so sorry. I need to forward this reply to the mail list. OK, because I think the submitted of imptcp could say something, so I have omitted some config. And the result of pstats is accumulated, not reset. If any other information can help, please tell me. The full config of sender is as be

Re: [rsyslog] Problems flushing with omprog

2020-02-12 Thread Joan Sala via rsyslog
The BrokenPipeError message could be related to how you write to stderr from your Python program. If you are writing without flushing immediately (as I recall from a previous question from you), then maybe Python tries to write the stderr buffer when the process exits (if there is a high load, rsys

Re: [rsyslog] Drop messages

2020-02-12 Thread Adam Barnett via rsyslog
oh, thanks for the tip On Wed, Feb 12, 2020 at 5:36 PM David Lang wrote: > when you have an issue like this, log the message to a file with the > template > RSYSLOG_DebugFormat so you can see exactly what is in each variable. That > would > show you why you aren't matching $msg > > David Lang >

Re: [rsyslog] Drop messages

2020-02-12 Thread David Lang via rsyslog
when you have an issue like this, log the message to a file with the template RSYSLOG_DebugFormat so you can see exactly what is in each variable. That would show you why you aren't matching $msg David Lang ___ rsyslog mailing list http://lists.adisco

Re: [rsyslog] Drop messages

2020-02-12 Thread Adam Barnett via rsyslog
Thanks, worked like a charm with $rawmsg On Wed, Feb 12, 2020 at 12:16 PM Rainer Gerhards wrote: > you do not need to process the message - just use this: > > if $msg contains ['VSAN', > 'VSANMGMTSVC'] > then { > stop > } > > If that doesn't work, $msg does

Re: [rsyslog] I found that many logs vanished on the way of omfwd, so how to check it?

2020-02-12 Thread David Lang via rsyslog
you don't show any config on the receiver that would write logs to any file. you don't show us the full config, so we don't know if the numbers in pstats are reset after each report or not David Lang On Wed, 12 Feb 2020, lxy via rsyslog wrote: Date: Wed, 12 Feb 2020 16:24:51 +0800 (CST) Fro

Re: [rsyslog] Casting Time Values

2020-02-12 Thread John Chivian via rsyslog
I have amended my original message below to show the correct $timereported value (not $timereceived which doesn't exist). The same format issue remains if $timegenerated is used. I also found and tried the format_time function... set $.my_tstamp = format_time($timereported, "date-rfc3339"); .

[rsyslog] Casting Time Values

2020-02-12 Thread John Chivian via rsyslog
Hello List: A quick question about casting time values. set $.my_tstamp = $timereceived; This results in $.my_tstamp being in format "Feb 12 13:52:35" when the property value is output in a template. This remains true even if dateFormat="rfc3339" is specified for the field in the template. 

Re: [rsyslog] rsyslog's programname

2020-02-12 Thread Peter Viskup via rsyslog
[Replying with mailing list address in recipients.] Thank you, Rainer, for quick answer. On Wed, Feb 12, 2020 at 3:31 PM Rainer Gerhards wrote: > El mié., 12 feb. 2020 a las 15:26, Peter Viskup via rsyslog > () escribió: > > > > In other case it seems those internal rsyslog messages are duplicit

Re: [rsyslog] rsyslog's programname

2020-02-12 Thread Rainer Gerhards via rsyslog
El mié., 12 feb. 2020 a las 15:26, Peter Viskup via rsyslog () escribió: > > Is there way to configure rsyslog instance to use its own programname? > For example rsyslog-net or rsyslog-lin for appropriate instances which have > different listen ports open. > As those usually run on the same host, t

[rsyslog] rsyslog's programname

2020-02-12 Thread Peter Viskup via rsyslog
Is there way to configure rsyslog instance to use its own programname? For example rsyslog-net or rsyslog-lin for appropriate instances which have different listen ports open. As those usually run on the same host, the error messages are logged under "rsyslog" and it is hard to decide what message

Re: [rsyslog] Drop messages

2020-02-12 Thread Rainer Gerhards via rsyslog
you do not need to process the message - just use this: if $msg contains ['VSAN', 'VSANMGMTSVC'] then { stop } If that doesn't work, $msg does not contain what you think. Try $rawmsg (everything as received from wire) in this case. Rainer El mié., 12 feb. 2

[rsyslog] Drop messages

2020-02-12 Thread Adam Barnett via rsyslog
Hi All, i am trying to drop sys log messages that contain certain words The message coming looks like so Feb 12 00:59:18 bd-c67b-85b3-1fa2-d50e69 mtlvdi52 VSANMGMTSVC: 641e7'}, {'uuid': '521c8928-2bbe-4258-eb7e-bb0c864ff357', 'isAllFlash': 0, 'owner': '5dcd75a4-f34c-4392-1b2f-e4434b870550', 'dis

Re: [rsyslog] I found that many logs vanished on the way of omfwd, so how to check it?

2020-02-12 Thread Rainer Gerhards via rsyslog
Maybe I overlook it, but where do you think the issue is? Rainer El mié., 12 feb. 2020 a las 9:25, lxy via rsyslog () escribió: > > Hello, all, > I used omfwd to forward my logs to an endpoint. But I found that many of them > have been vanished, but I don't know where to find them. > > > > The s

[rsyslog] I found that many logs vanished on the way of omfwd, so how to check it?

2020-02-12 Thread lxy via rsyslog
Hello, all, I used omfwd to forward my logs to an endpoint. But I found that many of them have been vanished, but I don't know where to find them. The status of sender is as below, and there are 40 senders. So the total numer is more than 12000. Wed Jan 29 21:48:43 2020: global: origin=dynstat