Debug log:
5028.756561447:main thread : rsyslogd.c:
5028.756591154:main thread : rsyslogd.c:
5028.756599828:main thread : rsyslogd.c: ********************************************************************************
5028.756602615:main thread : rsyslogd.c: Switching debugging_on to true at 08:03:48
5028.756604775:main thread : rsyslogd.c: ********************************************************************************
5028.756609995:main thread : janitor.c: janitorRun() called
5033.189177560:main thread : rsyslogd.c: DoDie called.
5033.189238695:main thread : rsyslogd.c: awaking mainthread
5033.189262942:main thread : janitor.c: janitorRun() called
5033.189269019:main thread : errmsg.c: Called LogMsg, msg: rsyslogd shutting down
5033.189271584:main thread : operatingstate.c: osf: MSG rsyslogd shutting down: signaling new internal message via SIGTTOU: 'rsyslogd shutting down [v8.2106.0 try
https://www.rsyslog.com/e/0 ]'
5033.189289381:main thread : rsyslogd.c: exiting on signal 2
5033.189291603:main thread : rsyslogd.c: Terminating input threads...
5033.189295410:main thread : ../threads.c: request term via SIGTTIN for input thread 'immark' 0x7ffab236f700
5033.189298582:main thread : ../threads.c: thread immark: initiating termination, timeout 1000 ms
5033.189348883:immark.c : ../threads.c: thrdStarter: usrThrdMain immark - 0x7ffab236f700 returned with iRet 0, exiting now.
5033.189379910:main thread : ../threads.c: non-cancel input thread termination succeeded for thread immark 0x7ffab236f700
5033.189585841:main thread : ../threads.c: request term via SIGTTIN for input thread 'imuxsock' 0x7ffab1f6e700
5033.189589416:main thread : ../threads.c: thread imuxsock: initiating termination, timeout 1000 ms
5033.189613241:imuxsock.c : ../threads.c: thrdStarter: usrThrdMain imuxsock - 0x7ffab1f6e700 returned with iRet 0, exiting now.
5033.189653202:main thread : ../threads.c: non-cancel input thread termination succeeded for thread imuxsock 0x7ffab1f6e700
5033.189665632:main thread : imuxsock.c: imuxsock: unlinking unix socket file[0] /dev/log
5033.189678050:main thread : ../threads.c: request term via canceling for input thread imklog
5033.189730551:main thread : ../threads.c: request term via SIGTTIN for input thread 'imtcp' 0x7ffab176c700
5033.189734384:main thread : ../threads.c: thread imtcp: initiating termination, timeout 1000 ms
5033.189757496:imtcp.c : nsdsel_ptcp.c: nsdsel_ptcp received EINTR
5033.189774472:imtcp.c : tcpsrv.c: tcpsrv terminating, waiting for 0 workers
5033.189778040:imtcp.c : ../threads.c: thrdStarter: usrThrdMain imtcp - 0x7ffab176c700 returned with iRet 0, exiting now.
5033.189787733:main thread : ../threads.c: non-cancel input thread termination succeeded for thread imtcp 0x7ffab176c700
5033.189862021:main thread : modules.c: file netstrms.c released module 'lmnsd_gtls', reference count now 1
5033.189873247:main thread : iminternal.c: signaling new internal message via SIGTTOU: '[origin software="rsyslogd" swVersion="8.2106.0" x-pid="19998" x-info="
https://www.rsyslog.com"] exiting on signal 2.'
5033.190033534:main thread : rsyslogd.c: Terminating main queue...
5033.190038517:main thread : main Q: queue.c: shutdown: begin to destruct queue
5033.190041457:main thread : main Q: queue.c: initiating worker thread shutdown sequence 0x55dc13dff4d0
5033.190043715:main thread : main Q: queue.c: trying shutdown of regular workers
5033.190050545:main thread : wti.c: sent SIGTTIN to worker thread 0x7ffaa3fff700
5033.190054214:main thread : wtp.c: main Q:Reg: waiting 1499ms on worker thread termination, 1 still running
5033.190070048:main Q:Reg/w0 : wti 0x55dc13e0df60: wti.c: worker awoke from idle processing
5033.190074442:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: we deleted 0 objects and enqueued 0 objects
5033.190076537:main Q:Reg/w0 : queue.c: rger: deleteBatchFromQStore, nElem 0
5033.190079265:main Q:Reg/w0 : queue.c: doDeleteBatch: delete batch from store, new sizes: log 0, phys 0
5033.190082092:main Q:Reg/w0 : main Q: queue.c: dequeued 0 consumable elements, szlog 0 sz phys 0
5033.190103817:main Q:Reg/w0 : queue.c: regular consumer finished, iret=4, szlog 0 sz phys 0
5033.190106754:main Q:Reg/w0 : wti 0x55dc13e0df60: wti.c: terminating worker terminateRet=5, bInactivityTOOccured=0
5033.190109572:main Q:Reg/w0 : wti.c: DDDD: wti 0x55dc13e0df60: worker cleanup action instances
5033.190111828:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 0, ptr 0x7ffa98000f30
5033.190115766:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 1, ptr 0x7ffa98001190
5033.190143536:main Q:Reg/w0 : modules.c: file netstrms.c released module 'lmnsd_gtls', reference count now 0
5033.190147864:main Q:Reg/w0 : modules.c: module 'lmnsd_gtls' has zero reference count, unloading...
5033.190150937:main Q:Reg/w0 : modules.c: Unloading module lmnsd_gtls
5033.190165121:main Q:Reg/w0 : modules.c: file nsdsel_gtls.c released module 'lmnsd_ptcp', reference count now 1
5033.190206154:main Q:Reg/w0 : modules.c: file nsd_gtls.c released module 'lmnsd_ptcp', reference count now 0
5033.190208707:main Q:Reg/w0 : modules.c: module 'lmnsd_ptcp' has zero reference count, unloading...
5033.190210845:main Q:Reg/w0 : modules.c: Unloading module lmnsd_ptcp
5033.190215279:main Q:Reg/w0 : modules.c: file nsd_ptcp.c released module 'lmnetstrms', reference count now 5
5033.190245353:main Q:Reg/w0 : modules.c: file nsd_gtls.c released module 'lmnet', reference count now 5
5033.190251310:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 2, ptr (nil)
5033.190253540:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 3, ptr (nil)
5033.190255659:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 4, ptr (nil)
5033.190257753:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 5, ptr (nil)
5033.190259842:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 6, ptr (nil)
5033.190262021:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 7, ptr (nil)
5033.190264115:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 8, ptr (nil)
5033.190266224:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 9, ptr (nil)
5033.190268445:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 10, ptr (nil)
5033.190270854:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 11, ptr (nil)
5033.190272890:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 12, ptr (nil)
5033.190274894:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 13, ptr (nil)
5033.190276953:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 14, ptr 0x7ffa98005980
5033.190280073:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 15, ptr (nil)
5033.190282197:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 16, ptr (nil)
5033.190284591:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 17, ptr (nil)
5033.190286640:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60, action 18, ptr (nil)
5033.190289919:main Q:Reg/w0 : wti.c: wti 0x55dc13e0df60: exiting
5033.190292908:main Q:Reg/w0 : wtp.c: main Q:Reg: Worker thread 55dc13e0df60, terminated, num workers now 0
5033.190364038:main thread : wti.c: sent SIGTTIN to worker thread 0x7ffaa3fff700
5033.190368540:main thread : main Q: queue.c: regular queue workers shut down.
5033.190371158:main thread : main Q: queue.c: checking to see if we need to cancel any worker threads of the primary queue
5033.190374081:main thread : wti.c: main Q:Reg/w0: joining terminated worker
5033.190376375:main thread : wti.c: main Q:Reg/w0: worker fully terminated
5033.190378718:main thread : main Q: queue.c: worker threads terminated, remaining queue size log 0, phys 0.
5033.190385043:main thread : main Q: queue.c: queue (type 0) will lose 0 messages, destroying...
5033.190400418:main thread : rsyslogd.c: Terminating outputs...
5033.190404021:main thread : ruleset.c: rulesetDestructAllActions
5033.190406235:main thread : ruleset.c: destructAllActions: queue shutdown
5033.190408990:main thread : ruleset.c: shutting down queue workers for ruleset 0x55dc13db9520, name RSYSLOG_DefaultRuleset, queue (nil)
5033.190411048:main thread : ruleset.c: destructAllActions: action and conf stmt shutdown
5033.190422196:main thread : ruleset.c: shutting down actions and conf stmts for ruleset 0x55dc13db9520, name RSYSLOG_DefaultRuleset
5033.190426463:main thread : action-0-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190431381:main thread : omfile.c: Removing entry 0 for file '/var/log/server/syslog.log' from dynaCache.
5033.190439324:main thread : strm 0x7ffa980059d0: stream.c: file 13(/var/log/server/syslog.log) closing, bDeleteOnClose 0
5033.190442130:main thread : strm 0x7ffa980059d0: stream.c: strmFlushinternal: file 13(/var/log/server/syslog.log) flush, buflen 0 (no need to flush)
5033.190444280:main thread : strm 0x7ffa980059d0: stream.c: file 13(/var/log/server/syslog.log) closing
5033.190451652:main thread : omfile.c: Removing entry 1 for file '/var/log/client.domain.com/user.log' from dynaCache.
5033.190454065:main thread : strm 0x7ffa9800a950: stream.c: file 16(/var/log/client.domain.com/user.log) closing, bDeleteOnClose 0
5033.190456336:main thread : strm 0x7ffa9800a950: stream.c: strmFlushinternal: file 16(/var/log/client.domain.com/user.log) flush, buflen 0 (no need to flush)
5033.190458429:main thread : strm 0x7ffa9800a950: stream.c: file 16(/var/log/client.domain.com/user.log) closing
5033.190463135:main thread : omfile.c: Removing entry 2 for file '/var/log/server/auth.log' from dynaCache.
5033.190465460:main thread : strm 0x7ffa9800cde0: stream.c: file 17(/var/log/server/auth.log) closing, bDeleteOnClose 0
5033.190467628:main thread : strm 0x7ffa9800cde0: stream.c: strmFlushinternal: file 17(/var/log/server/auth.log) flush, buflen 0 (no need to flush)
5033.190470101:main thread : strm 0x7ffa9800cde0: stream.c: file 17(/var/log/server/auth.log) closing
5033.190475382:main thread : omfile.c: Removing entry 3 for file '/var/log/server/authpriv.log' from dynaCache.
5033.190477683:main thread : strm 0x7ffa9800f130: stream.c: file 18(/var/log/server/authpriv.log) closing, bDeleteOnClose 0
5033.190479851:main thread : strm 0x7ffa9800f130: stream.c: strmFlushinternal: file 18(/var/log/server/authpriv.log) flush, buflen 0 (no need to flush)
5033.190481986:main thread : strm 0x7ffa9800f130: stream.c: file 18(/var/log/server/authpriv.log) closing
5033.190488121:main thread : action-1-builtin:omfwd queue: queue.c: shutdown: begin to destruct queue
5033.190493412:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb540, type 'OR'
5033.190495967:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb3a0, type 'AND'
5033.190498210:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dc5ea0, type 'F'
5033.190502327:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb380, type 'NOT'
5033.190504529:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb360, type 'AND'
5033.190506649:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb290, type 'CMP_CONTAINS'
5033.190508856:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd0940, type 'V'
5033.190511123:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb270, type 'S'
5033.190513881:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb340, type 'CMP_CONTAINS'
5033.190515927:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb2d0, type 'V'
5033.190518042:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dcb320, type 'S'
5033.190520192:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dc5f10, type 'F'
5033.190522701:main thread : action-2-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190526715:main thread : action-3-builtin:ompipe queue: queue.c: shutdown: begin to destruct queue
5033.190530576:main thread : action-4-builtin:omusrmsg queue: queue.c: shutdown: begin to destruct queue
5033.190534325:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5af0, type 'OR'
5033.190536429:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd1d50, type 'CMP_EQ'
5033.190541657:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dda810, type 'V'
5033.190543823:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd1d30, type 'S'
5033.190546016:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5ad0, type 'CMP_STARTSWITH'
5033.190548232:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd2830, type 'V'
5033.190550335:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5ab0, type 'S'
5033.190552537:main thread : action-5-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190555932:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd4ae0, type 'AND'
5033.190558030:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd4a30, type 'OR'
5033.190560214:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5e20, type 'CMP_EQ'
5033.190562327:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5950, type 'V'
5033.190564412:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5de0, type 'S'
5033.190566470:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd4a10, type 'CMP_EQ'
5033.190568509:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5980, type 'V'
5033.190570599:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd49f0, type 'S'
5033.190572679:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dc5fb0, type 'F'
5033.190575390:main thread : action-6-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190578760:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd58b0, type 'AND'
5033.190580822:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dc6050, type 'F'
5033.190583017:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5890, type 'AND'
5033.190585065:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd57c0, type 'CMP_CONTAINS'
5033.190587099:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd4910, type 'V'
5033.190589145:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd57a0, type 'S'
5033.190591231:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5870, type 'CMP_CONTAINS'
5033.190593259:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5800, type 'V'
5033.190595284:main thread : rainerscript.c: cnfexprDestruct expr 0x55dc13dd5850, type 'S'
5033.190618132:main thread : action-7-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190622497:main thread : action-8-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190626890:main thread : action-9-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190640887:main thread : action-10-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190654111:main thread : action-11-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190657873:main thread : action-12-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190661614:main thread : action-13-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190664900:main thread : action-14-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190668788:main thread : strm 0x7ffa98007dd0: stream.c: file 14(/var/log/messages) closing, bDeleteOnClose 0
5033.190671084:main thread : strm 0x7ffa98007dd0: stream.c: strmFlushinternal: file 14(/var/log/messages) flush, buflen 0 (no need to flush)
5033.190673278:main thread : strm 0x7ffa98007dd0: stream.c: file 14(/var/log/messages) closing
5033.190678652:main thread : action-15-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190682221:main thread : action-16-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190686134:main thread : action-17-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190689802:main thread : action-18-builtin:omfile queue: queue.c: shutdown: begin to destruct queue
5033.190697344:main thread : ruleset.c: destructing ruleset 0x55dc13db9520, name 0x55dc13db9560
5033.190700295:main thread : rsyslogd.c: all primary multi-thread sources have been terminated - now doing aux cleanup...
5033.190702315:main thread : rsyslogd.c: destructing current config...
5033.190704909:main thread : rsconf.c: calling freeCnf(0x55dc13db75a0) for module 'builtin:omfile'
5033.190707318:main thread : rsconf.c: calling freeCnf(0x55dc13db7770) for module 'builtin:ompipe'
5033.190709986:main thread : rsconf.c: calling freeCnf(0x55dc13db8770) for module 'builtin:omfwd'
5033.190713355:main thread : rsconf.c: calling freeCnf(0x55dc13dc7750) for module 'immark.so'
5033.190716019:main thread : rsconf.c: calling freeCnf(0x55dc13dc9610) for module 'imuxsock.so'
5033.190718553:main thread : rsconf.c: calling freeCnf(0x55dc13dca860) for module 'imklog.so'
5033.190721080:main thread : rsconf.c: calling freeCnf(0x55dc13dce700) for module 'imtcp'
5033.190770096:main thread : parser.c: destructing parser 'rsyslog.rfc5424'
5033.190772594:main thread : parser.c: destructing parser 'rsyslog.rfc3164'
5033.190775196:main thread : pmrfc3164.c: pmrfc3164: free parser instance 0x55dc13db8c50
5033.190782063:main thread : modules.c: file rsyslogd.c released module 'lmnet', reference count now 4
5033.190784438:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 4
5033.190786550:main thread : modules.c: Unloading module builtin:omfile
5033.190789213:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 4
5033.190791251:main thread : modules.c: Unloading module builtin:ompipe
5033.190793495:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 4
5033.190795495:main thread : modules.c: Unloading module builtin-shell
5033.190797779:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 4
5033.190799779:main thread : modules.c: Unloading module builtin:omdiscard
5033.190801963:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 4
5033.190803931:main thread : modules.c: Unloading module builtin:omfwd
5033.190806440:main thread : modules.c: file omfwd.c released module 'lmnet', reference count now 3
5033.190808989:main thread : modules.c: file omfwd.c released module 'lmnetstrms', reference count now 4
5033.190811446:main thread : modules.c: file omfwd.c released module 'lmnetstrms', reference count now 3
5033.190813714:main thread : modules.c: file omfwd.c released module 'lmtcpclt', reference count now 0
5033.190815745:main thread : modules.c: module 'lmtcpclt' has zero reference count, unloading...
5033.190817745:main thread : modules.c: Unloading module lmtcpclt
5033.190839888:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190843191:main thread : modules.c: Unloading module builtin:omusrmsg
5033.190845438:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190847453:main thread : modules.c: Unloading module builtin:pmrfc5424
5033.190850027:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190852192:main thread : modules.c: Unloading module builtin:pmrfc3164
5033.190854646:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190856622:main thread : modules.c: Unloading module builtin:smfile
5033.190859169:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190861201:main thread : modules.c: Unloading module builtin:smtradfile
5033.190863571:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190865540:main thread : modules.c: Unloading module builtin:smfwd
5033.190867983:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190870023:main thread : modules.c: Unloading module builtin:smtradfwd
5033.190876126:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190878217:main thread : modules.c: Unloading module immark.so
5033.190900578:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190903458:main thread : modules.c: Unloading module imuxsock.so
5033.190929023:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190931871:main thread : modules.c: Unloading module imklog.so
5033.190944049:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 3
5033.190946751:main thread : modules.c: module lmnetstrms NOT unloaded because it still has a refcount of 3
5033.190948843:main thread : modules.c: module lmtcpsrv NOT unloaded because it still has a refcount of 2
5033.190950930:main thread : modules.c: Unloading module imtcp
5033.190954270:main thread : modules.c: file imtcp.c released module 'lmnet', reference count now 2
5033.190956666:main thread : modules.c: file imtcp.c released module 'lmnetstrms', reference count now 2
5033.190959070:main thread : modules.c: file imtcp.c released module 'lmtcpsrv', reference count now 1
5033.190961401:main thread : modules.c: file imtcp.c released module 'lmtcpsrv', reference count now 0
5033.190963424:main thread : modules.c: module 'lmtcpsrv' has zero reference count, unloading...
5033.190965470:main thread : modules.c: Unloading module lmtcpsrv
5033.191000080:main thread : tcpsrv.c: tcpsrv: info: worker 0 was called 0 times
5033.191022031:main thread : tcpsrv.c: tcpsrv: info: worker 1 was called 0 times
5033.191042824:main thread : tcpsrv.c: tcpsrv: info: worker 2 was called 0 times
5033.191077377:main thread : tcpsrv.c: tcpsrv: info: worker 3 was called 0 times
5033.191082074:main thread : modules.c: file tcpsrv.c released module 'lmnetstrms', reference count now 1
5033.191084651:main thread : modules.c: file tcpsrv.c released module 'lmnet', reference count now 1
5033.191087761:main thread : modules.c: file tcps_sess.c released module 'lmnetstrms', reference count now 0
5033.191089779:main thread : modules.c: module 'lmnetstrms' has zero reference count, unloading...
5033.191091922:main thread : modules.c: Unloading module lmnetstrms
5033.191128059:main thread : modules.c: module lmnet NOT unloaded because it still has a refcount of 1
5033.191131700:main thread : modules.c: file conf.c released module 'lmnet', reference count now 0
5033.191133723:main thread : modules.c: module 'lmnet' has zero reference count, unloading...
5033.191135781:main thread : modules.c: Unloading module lmnet
5033.191152212:main thread : strgen.c: destructing strgen 'RSYSLOG_FileFormat'
5033.191155173:main thread : strgen.c: destructing strgen 'RSYSLOG_TraditionalFileFormat'
5033.191157204:main thread : strgen.c: destructing strgen 'RSYSLOG_ForwardFormat'
5033.191159298:main thread : strgen.c: destructing strgen 'RSYSLOG_TraditionalForwardFormat'
5033.191164325:main thread : rsyslog.c: rsyslog runtime de-initialized, current users 0
5033.191166536:main thread : rsyslogd.c: Clean shutdown completed, bye
-----Original Message-----
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
Sent: Thursday, May 26, 2022 12:54 PM
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Grzegorz Zalewski <Grzegorz.Zalewski@inteco.pl>
Subject: Re: [rsyslog] Rsyslog bad external log encoding ??????
[EXTERNAL EMAIL] Please report any suspicious attachments, links, or requests for sensitive information.
can you do a debug log on the server side, make sure TLS is enabled and run rsyslog through the startup phase? I would assume that we see useful information.
quick doc:
https://www.rsyslog.com/doc/master/troubleshooting/howtodebug.html Rainer
El jue, 26 may 2022 a las 8:18, Grzegorz Zalewski via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hi
>
> When I turn off TLS work fine :/
>
> I does`t see any errors on server logs
>
> -----Original Message-----
> From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Sent: Wednesday, May 25, 2022 6:39 PM
> To: rsyslog-users <rsyslog@lists.adiscon.com>
> Cc: Grzegorz Zalewski <Grzegorz.Zalewski@inteco.pl>
> Subject: Re: [rsyslog] Rsyslog bad external log encoding ??????
>
> [EXTERNAL EMAIL] Please report any suspicious attachments, links, or requests for sensitive information.
>
> This looks like the server is not using TLS. Any rsyslog error messages in the server log?
>
> Rainer
>
> El mié, 25 may 2022 a las 15:02, Grzegorz Zalewski via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
> >
> > Hi
> > My version of rsyslogd on log sever:
> > rsyslogd 8.2106.0 (aka 2021.06) compiled with:
> > PLATFORM: x86_64-suse-linux-gnu
> > PLATFORM (lsb_release -d):
> > FEATURE_REGEXP: Yes
> > GSSAPI Kerberos 5 support: Yes
> > FEATURE_DEBUG (debug build, slow code): No
> > 32bit Atomic operations supported: Yes
> > 64bit Atomic operations supported: Yes
> > memory allocator: system default
> > Runtime Instrumentation (slow code): No
> > uuid support: Yes
> > systemd support: Yes
> > Config file: /etc/rsyslog.conf
> > PID file: /var/run/rsyslogd.pid
> > Number of Bits in RainerScript integers: 64
> >
> > # ######### Receiving Messages from Remote Hosts ##########.
> > ########### Encrypting Syslog Traffic with TLS ########## # -- TLS
> > Syslog Server:.
> > ## make gtls driver the default
> > $DefaultNetstreamDriver gtls
> > #
> > ## certificate files
> > $DefaultNetstreamDriverCAFile /etc/rsyslog-keys/CA_server.pem
> > $DefaultNetstreamDriverCertFile /etc/rsyslog-keys/server.pem
> > $DefaultNetstreamDriverKeyFile /etc/rsyslog-keys/server.pem
> >
> > $ModLoad imtcp # load TCP listener
> > #
> > $InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
> > #$InputTCPServerStreamDriverAuthMode anon # client is NOT
> > authenticated $InputTCPServerStreamDriverAuthMode x509/name
> > $InputTCPServerStreamDriverPermittedPeer *.domain.com
> > $InputTCPServerRun 514 # start up listener at port 10514 #
> > #$EscapeControlCharactersOnReceive off
> > #$Escape8BitCharactersOnReceive off
> >
> > $template RemoteServer, "/var/log/%HOSTNAME%/%SYSLOGFACILITY-TEXT%.log"
> > *.* ?RemoteServer
> >
> > Client conf:
> > # certificate files - just CA for a client
> > $DefaultNetstreamDriverCAFile /etc/rsyslog-keys/CA_client.pem
> >
> > # set up the action
> > $DefaultNetstreamDriver gtls # use gtls netstream driver
> > $ActionSendStreamDriverMode 1 # require TLS for the connection
> > $ActionSendStreamDriverAuthMode x509/name
> >
> > #$ActionSendStreamDriverAuthMode anon # server is NOT authenticated
> >
> > # Only send log to SERVER.EXAMPLE.COM host
> > $ActionSendStreamDriverPermittedPeer server.domain.com
> > *.* @@(o) server.domain.com:514 # send (all) messages
> >
> > What have in log on server:
> > 2022-05-25T14:44:32.782021+02:00 client.domain.com #010#005#005#003#010#010#006#001#010#013#010#006#006#003#002#001#002#003#000#026#000#000#000#027#000#000#000##000#000.#001#000#001#000#000#000#000#034#000#032#000#000#027server.
> > domain.coml#000#034#000#002@
> > 2022-05-25T14:44:32.887714+02:00 client.domain.com #026#003#001#000.#001#000#000.#003#003·...?#030J#026#004..#037)#021n.#030..#021..rw..F..#000#0002.,?...
> > 2022-05-25T14:44:32.887714+02:00 client.domain.com
> > .+...#011.0?.#024./.#023#000...#0005#000...#000/#000...#0009#000...#
> > 00
> > 03#001#000#000.#000#005#000#005#001#000#000#000#000
> > 2022-05-25T14:44:32.887714+02:00 client.domain.com
> > #000#026#000#024#000#027#000#030#000#031#000#035#000#036#001#000#001
> > #0
> > 01#001#002#001#003#001#004#000#013#000#002#001#000#000#015#000"#000
> > #004#001#010#011#010#004#004#003#010#007#00
> > 5#001#010
> >
> > Before 15 may working fine.
> > I don’t have any idea what is wrong
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow
https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.