Mailing List Archive

Double timestamp + hostname
Hi,

just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
like this:

2019-01-31T13:13:28.489805+01:00 server2
2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
Old server shows:

2019-01-31T13:14:39.322311+01:00 kzk root: test

Any idea why this is? What has changed and how do I get rid of the
double timestamp/host?

Nick
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Double timestamp + hostname [ In reply to ]
More information is needed to say for sure, but your test message comes
before the blank message making me think it's a double line feed issue
at input.

How did you generate that message? What does your rsyslog.conf look like?

On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote:
> Hi,
>
> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
> like this:
>
> 2019-01-31T13:13:28.489805+01:00 server2
> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
> Old server shows:
>
> 2019-01-31T13:14:39.322311+01:00 kzk root: test
>
> Any idea why this is? What has changed and how do I get rid of the
> double timestamp/host?
>
> Nick
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Double timestamp + hostname [ In reply to ]
Hi,

rsyslog.conf (identical on old and new system):

module(load="immark")
module(load="imuxsock")
module(load="imklog")

*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
/var/log/messages
security.*
/var/log/security
auth.info;authpriv.info
/var/log/auth.log
mail.info /var/log/maillog
lpr.info
/var/log/lpd-errs
ftp.info /var/log/xferlog
cron.* /var/log/cron
*.=debug
/var/log/debug.log

test (on both old and new system): # logger test

This happens for all messages, not only the ones I send with logger.
e.g. /var/log/cron

2019-01-31T00:15:12.850021+01:00 server1 1
2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic
daily' completed (mailing output)

I've also tested this with the simplest of rsyslog.conf I could think
which was 1 line:
*.* /var/log/all.log

This also gave the same problem. These FreeBSD-servers runs several
jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly
with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test
8.1901.0) all jails and main system experience the issue.

Nick

On Thu, 31 Jan 2019 at 16:47, John Chivian <jchivian@chivian.com> wrote:
>
> More information is needed to say for sure, but your test message comes
> before the blank message making me think it's a double line feed issue
> at input.
>
> How did you generate that message? What does your rsyslog.conf look like?
>
> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote:
> > Hi,
> >
> > just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
> > rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
> > like this:
> >
> > 2019-01-31T13:13:28.489805+01:00 server2
> > 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
> > Old server shows:
> >
> > 2019-01-31T13:14:39.322311+01:00 kzk root: test
> >
> > Any idea why this is? What has changed and how do I get rid of the
> > double timestamp/host?
> >
> > Nick
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.



--
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Double timestamp + hostname [ In reply to ]
Interesting.  I have no experience with FreeBSD but you seem to have
eliminated any configuration issue. Does the same thing happen if you
output an event stream over the network?  I ask because rsyslog applies
different templates to different output types and now I'm wondering if
the file output template is off.

Regards,


On 1/31/19 10:13 AM, Nick Rosier via rsyslog wrote:
> Hi,
>
> rsyslog.conf (identical on old and new system):
>
> module(load="immark")
> module(load="imuxsock")
> module(load="imklog")
>
> *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
> /var/log/messages
> security.*
> /var/log/security
> auth.info;authpriv.info
> /var/log/auth.log
> mail.info /var/log/maillog
> lpr.info
> /var/log/lpd-errs
> ftp.info /var/log/xferlog
> cron.* /var/log/cron
> *.=debug
> /var/log/debug.log
>
> test (on both old and new system): # logger test
>
> This happens for all messages, not only the ones I send with logger.
> e.g. /var/log/cron
>
> 2019-01-31T00:15:12.850021+01:00 server1 1
> 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic
> daily' completed (mailing output)
>
> I've also tested this with the simplest of rsyslog.conf I could think
> which was 1 line:
> *.* /var/log/all.log
>
> This also gave the same problem. These FreeBSD-servers runs several
> jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly
> with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test
> 8.1901.0) all jails and main system experience the issue.
>
> Nick
>
> On Thu, 31 Jan 2019 at 16:47, John Chivian <jchivian@chivian.com> wrote:
>> More information is needed to say for sure, but your test message comes
>> before the blank message making me think it's a double line feed issue
>> at input.
>>
>> How did you generate that message? What does your rsyslog.conf look like?
>>
>> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote:
>>> Hi,
>>>
>>> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
>>> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
>>> like this:
>>>
>>> 2019-01-31T13:13:28.489805+01:00 server2
>>> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
>>> Old server shows:
>>>
>>> 2019-01-31T13:14:39.322311+01:00 kzk root: test
>>>
>>> Any idea why this is? What has changed and how do I get rid of the
>>> double timestamp/host?
>>>
>>> Nick
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
>
> --
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Double timestamp + hostname [ In reply to ]
I think there is an issue about a change in FreeBSD 12 logging format.
Maybe it hits us. That remembers me that we had someone who wanted to
help setup a slave for that version.

El jue., 31 ene. 2019 a las 17:39, John Chivian
(<jchivian@chivian.com>) escribió:
>
> Interesting. I have no experience with FreeBSD but you seem to have
> eliminated any configuration issue. Does the same thing happen if you
> output an event stream over the network? I ask because rsyslog applies
> different templates to different output types and now I'm wondering if
> the file output template is off.
>
> Regards,
>
>
> On 1/31/19 10:13 AM, Nick Rosier via rsyslog wrote:
> > Hi,
> >
> > rsyslog.conf (identical on old and new system):
> >
> > module(load="immark")
> > module(load="imuxsock")
> > module(load="imklog")
> >
> > *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
> > /var/log/messages
> > security.*
> > /var/log/security
> > auth.info;authpriv.info
> > /var/log/auth.log
> > mail.info /var/log/maillog
> > lpr.info
> > /var/log/lpd-errs
> > ftp.info /var/log/xferlog
> > cron.* /var/log/cron
> > *.=debug
> > /var/log/debug.log
> >
> > test (on both old and new system): # logger test
> >
> > This happens for all messages, not only the ones I send with logger.
> > e.g. /var/log/cron
> >
> > 2019-01-31T00:15:12.850021+01:00 server1 1
> > 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic
> > daily' completed (mailing output)
> >
> > I've also tested this with the simplest of rsyslog.conf I could think
> > which was 1 line:
> > *.* /var/log/all.log
> >
> > This also gave the same problem. These FreeBSD-servers runs several
> > jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly
> > with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test
> > 8.1901.0) all jails and main system experience the issue.
> >
> > Nick
> >
> > On Thu, 31 Jan 2019 at 16:47, John Chivian <jchivian@chivian.com> wrote:
> >> More information is needed to say for sure, but your test message comes
> >> before the blank message making me think it's a double line feed issue
> >> at input.
> >>
> >> How did you generate that message? What does your rsyslog.conf look like?
> >>
> >> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote:
> >>> Hi,
> >>>
> >>> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
> >>> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
> >>> like this:
> >>>
> >>> 2019-01-31T13:13:28.489805+01:00 server2
> >>> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
> >>> Old server shows:
> >>>
> >>> 2019-01-31T13:14:39.322311+01:00 kzk root: test
> >>>
> >>> Any idea why this is? What has changed and how do I get rid of the
> >>> double timestamp/host?
> >>>
> >>> Nick
> >>> _______________________________________________
> >>> rsyslog mailing list
> >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> http://www.rsyslog.com/professional-services/
> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >>
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
> >
> > --
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Double timestamp + hostname [ In reply to ]
I'd have to check over the network. Will get back to you on that.

I've installed 8.35 and the problem persists so that leads me to think
it's a change on FreeBSD. Configure a RPI with Debian and rsyslogd to
forward messages to a FreeBSD rsyslogd. Using the same method (logger
test) I get the correctly formatted messages in /var/log/messages.

So all points to some change in FreeBSD 12.

N.

On Thu, 31 Jan 2019 at 17:39, John Chivian <jchivian@chivian.com> wrote:
>
> Interesting. I have no experience with FreeBSD but you seem to have
> eliminated any configuration issue. Does the same thing happen if you
> output an event stream over the network? I ask because rsyslog applies
> different templates to different output types and now I'm wondering if
> the file output template is off.
>
> Regards,
>
>
> On 1/31/19 10:13 AM, Nick Rosier via rsyslog wrote:
> > Hi,
> >
> > rsyslog.conf (identical on old and new system):
> >
> > module(load="immark")
> > module(load="imuxsock")
> > module(load="imklog")
> >
> > *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
> > /var/log/messages
> > security.*
> > /var/log/security
> > auth.info;authpriv.info
> > /var/log/auth.log
> > mail.info /var/log/maillog
> > lpr.info
> > /var/log/lpd-errs
> > ftp.info /var/log/xferlog
> > cron.* /var/log/cron
> > *.=debug
> > /var/log/debug.log
> >
> > test (on both old and new system): # logger test
> >
> > This happens for all messages, not only the ones I send with logger.
> > e.g. /var/log/cron
> >
> > 2019-01-31T00:15:12.850021+01:00 server1 1
> > 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic
> > daily' completed (mailing output)
> >
> > I've also tested this with the simplest of rsyslog.conf I could think
> > which was 1 line:
> > *.* /var/log/all.log
> >
> > This also gave the same problem. These FreeBSD-servers runs several
> > jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly
> > with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test
> > 8.1901.0) all jails and main system experience the issue.
> >
> > Nick
> >
> > On Thu, 31 Jan 2019 at 16:47, John Chivian <jchivian@chivian.com> wrote:
> >> More information is needed to say for sure, but your test message comes
> >> before the blank message making me think it's a double line feed issue
> >> at input.
> >>
> >> How did you generate that message? What does your rsyslog.conf look like?
> >>
> >> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote:
> >>> Hi,
> >>>
> >>> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
> >>> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
> >>> like this:
> >>>
> >>> 2019-01-31T13:13:28.489805+01:00 server2
> >>> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
> >>> Old server shows:
> >>>
> >>> 2019-01-31T13:14:39.322311+01:00 kzk root: test
> >>>
> >>> Any idea why this is? What has changed and how do I get rid of the
> >>> double timestamp/host?
> >>>
> >>> Nick
> >>> _______________________________________________
> >>> rsyslog mailing list
> >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> http://www.rsyslog.com/professional-services/
> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >>
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
> >
> > --
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.



--
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Double timestamp + hostname [ In reply to ]
Found this: https://svnweb.freebsd.org/base/head/UPDATING?r1=332100&r2=332099&pathrev=332100


76 When using rsyslog, disable the 'SysSock.UseSpecialParser' option
77 of the 'imuxsock' module to let messages be processed by the
78 regular RFC 3164/5424 parsing pipeline:
79
80 module(load="imuxsock" SysSock.UseSpecialParser="off")

Guess this is a workaround which should be fixed in the code?

On Thu, 31 Jan 2019 at 18:10, Nick Rosier <nick.rosier@gmail.com> wrote:
>
> I'd have to check over the network. Will get back to you on that.
>
> I've installed 8.35 and the problem persists so that leads me to think
> it's a change on FreeBSD. Configure a RPI with Debian and rsyslogd to
> forward messages to a FreeBSD rsyslogd. Using the same method (logger
> test) I get the correctly formatted messages in /var/log/messages.
>
> So all points to some change in FreeBSD 12.
>
> N.
>
> On Thu, 31 Jan 2019 at 17:39, John Chivian <jchivian@chivian.com> wrote:
> >
> > Interesting. I have no experience with FreeBSD but you seem to have
> > eliminated any configuration issue. Does the same thing happen if you
> > output an event stream over the network? I ask because rsyslog applies
> > different templates to different output types and now I'm wondering if
> > the file output template is off.
> >
> > Regards,
> >
> >
> > On 1/31/19 10:13 AM, Nick Rosier via rsyslog wrote:
> > > Hi,
> > >
> > > rsyslog.conf (identical on old and new system):
> > >
> > > module(load="immark")
> > > module(load="imuxsock")
> > > module(load="imklog")
> > >
> > > *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
> > > /var/log/messages
> > > security.*
> > > /var/log/security
> > > auth.info;authpriv.info
> > > /var/log/auth.log
> > > mail.info /var/log/maillog
> > > lpr.info
> > > /var/log/lpd-errs
> > > ftp.info /var/log/xferlog
> > > cron.* /var/log/cron
> > > *.=debug
> > > /var/log/debug.log
> > >
> > > test (on both old and new system): # logger test
> > >
> > > This happens for all messages, not only the ones I send with logger.
> > > e.g. /var/log/cron
> > >
> > > 2019-01-31T00:15:12.850021+01:00 server1 1
> > > 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic
> > > daily' completed (mailing output)
> > >
> > > I've also tested this with the simplest of rsyslog.conf I could think
> > > which was 1 line:
> > > *.* /var/log/all.log
> > >
> > > This also gave the same problem. These FreeBSD-servers runs several
> > > jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly
> > > with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test
> > > 8.1901.0) all jails and main system experience the issue.
> > >
> > > Nick
> > >
> > > On Thu, 31 Jan 2019 at 16:47, John Chivian <jchivian@chivian.com> wrote:
> > >> More information is needed to say for sure, but your test message comes
> > >> before the blank message making me think it's a double line feed issue
> > >> at input.
> > >>
> > >> How did you generate that message? What does your rsyslog.conf look like?
> > >>
> > >> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote:
> > >>> Hi,
> > >>>
> > >>> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with
> > >>> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages
> > >>> like this:
> > >>>
> > >>> 2019-01-31T13:13:28.489805+01:00 server2
> > >>> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test
> > >>> Old server shows:
> > >>>
> > >>> 2019-01-31T13:14:39.322311+01:00 kzk root: test
> > >>>
> > >>> Any idea why this is? What has changed and how do I get rid of the
> > >>> double timestamp/host?
> > >>>
> > >>> Nick
> > >>> _______________________________________________
> > >>> rsyslog mailing list
> > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >>> http://www.rsyslog.com/professional-services/
> > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > >>
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > >
> > >
> > > --
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
>
>
> --



--
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.