Re: [rsyslog] Split messages options

2017-07-10 Thread Scot Kreienkamp
" address="127.0.0.1" ruleset="RMS-Ecomm-1514-1531") Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com -Original Message---

Re: [rsyslog] Split messages options

2017-07-10 Thread David Lang
Sent: Monday, July 10, 2017 4:56 PM To: rsyslog-users <rsyslog@lists.adiscon.com> Subject: Re: [rsyslog] Split messages options note that there is some potential for messages to get out of order (over the network with UDP, and inside rsyslog if you use disk queues or multiple threads

Re: [rsyslog] Split messages options

2017-07-10 Thread Scot Kreienkamp
Sent: Monday, July 10, 2017 4:56 PM To: rsyslog-users <rsyslog@lists.adiscon.com> Subject: Re: [rsyslog] Split messages options note that there is some potential for messages to get out of order (over the network with UDP, and inside rsyslog if you use disk queues or multiple threads) UDP me

Re: [rsyslog] Split messages options

2017-07-10 Thread David Lang
om> Subject: Re: [rsyslog] Split messages options That makes sense, I wasn't aware of the limitation in log4j. And yes, it is a very old implementation and getting them to update would likely take years. :-) In my case I'm transporting the logfile from the prod servers to a common collector

Re: [rsyslog] Split messages options

2017-07-10 Thread Scot Kreienkamp
| | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com -Original Message- From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of David Lang Sent: Monday, July 10, 2017 4:38 PM To: rsyslog-users <rsyslog@lists.adiscon.com> Subject: Re: [rsyslog] Split messages option

Re: [rsyslog] Split messages options

2017-07-10 Thread David Lang
ahh, if this is a very old log4j, it will refuse to send UDP messages >1K in size, so it splits things before they get to rsyslog, and your maxmessagesize isn't going to help. normally I am not in favor of writing to disk and then reading them, but if you are stuck with an old log4j, that may

Re: [rsyslog] Split messages options

2017-07-10 Thread Scot Kreienkamp
To: rsyslog-users <rsyslog@lists.adiscon.com> Subject: Re: [rsyslog] Split messages options you don't show us your imfile config, check to see if the java program is outputting multi-line messages (and if so, are you handling them correctly) with current rsyslo versions, I have set the maxmessa

Re: [rsyslog] Split messages options

2017-07-10 Thread David Lang
you don't show us your imfile config, check to see if the java program is outputting multi-line messages (and if so, are you handling them correctly) with current rsyslo versions, I have set the maxmessagesize larger than 64k unfortunantly, rsyslog processes each message it sees independently,

[rsyslog] Split messages options

2017-07-10 Thread Scot Kreienkamp
Hi everyone, I have a java program that is using log4j to write into rsyslog. The messages are so large they are getting split, which causes the sorting rule (if $syslogtag == 'RMS-Tomcat:' then) to write the first part to the correct file, but the second part goes into messages because it