I am using rsyslog to transfer log files from a client (ver. 8.24.0) to a
server (ver. 5.8.10) via TCP.
I have also configured rsyslog.conf in the server to append a hostname and
date to a transferred log file name. $MaxMessageSize is unset (default).
Now I am experiencing the following strange phenomena.
a. In the folder for transferred log files, I found log files with broken
names like "ter-20190618.log" other than normal log files. Opening such a
file, it says:
> Jun 18 2019 14:17:00 ter errors will be ...
The fifth word, quite often some truncated English word, in a log file seems
to be taken as the /hostname/ in its file name.
In addition, most of these files have very small size and usually only one
line.
b. Original logs in the client and tranferred logs in the server are
different. Long lines in original logs are truncated; transferred logs can
contain up to 2044 characters per line.
c. Such a splited small log seems to have been generated when truncation
occurred, and it contains a part of truncated messages.
In this URL
<http://rsyslog-users.1305293.n2.nabble.com/Long-line-can-t-understand-forward-truncation-reason-td7594369.html>
, a similar issue was discussed even though it is not identical to mine.
My questions are as follows.
1. Can truncation of a long message cause those split log files? If so, how
can I fix this?
2. If not, what would be a cause of my probrems?
3. Will updating rsyslog on the server to ver. 8.24.0 fix / alleviate these
problems?
Any help will be much appreciated.
With best regards,
Tomoaki Hashizaki
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
server (ver. 5.8.10) via TCP.
I have also configured rsyslog.conf in the server to append a hostname and
date to a transferred log file name. $MaxMessageSize is unset (default).
Now I am experiencing the following strange phenomena.
a. In the folder for transferred log files, I found log files with broken
names like "ter-20190618.log" other than normal log files. Opening such a
file, it says:
> Jun 18 2019 14:17:00 ter errors will be ...
The fifth word, quite often some truncated English word, in a log file seems
to be taken as the /hostname/ in its file name.
In addition, most of these files have very small size and usually only one
line.
b. Original logs in the client and tranferred logs in the server are
different. Long lines in original logs are truncated; transferred logs can
contain up to 2044 characters per line.
c. Such a splited small log seems to have been generated when truncation
occurred, and it contains a part of truncated messages.
In this URL
<http://rsyslog-users.1305293.n2.nabble.com/Long-line-can-t-understand-forward-truncation-reason-td7594369.html>
, a similar issue was discussed even though it is not identical to mine.
My questions are as follows.
1. Can truncation of a long message cause those split log files? If so, how
can I fix this?
2. If not, what would be a cause of my probrems?
3. Will updating rsyslog on the server to ver. 8.24.0 fix / alleviate these
problems?
Any help will be much appreciated.
With best regards,
Tomoaki Hashizaki
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.