Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread helices via rsyslog
https://pastebin.com/DUgwmPCs On Tue, Dec 13, 2022 at 9:02 AM Rainer Gerhards wrote: > well, for the debug log to make sense to me, I need the whole thing at > least for the startup sequence. You can post it in a gist or something > like pastebin. I guess David would also be interested in it. >

Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread Rainer Gerhards via rsyslog
well, for the debug log to make sense to me, I need the whole thing at least for the startup sequence. You can post it in a gist or something like pastebin. I guess David would also be interested in it. Rainer El mar, 13 dic 2022 a las 15:57, helices () escribió: > > I'm trying to understand

Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread helices via rsyslog
I'm trying to understand what is really happening. Recently, it seems one of our clients initiates many SFTP connections to this host in the early morning hours. There are many, many rsyslog entries for this, and they are also those - apparently - wrapping across multiple lines, which fail

Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread Rainer Gerhards via rsyslog
I am a bit confused if/how this shall relate to the imjournal rate limiter, but... well.. you may know - especially if it helped ;-) As to troubleshooting the SQL issue: did you manually try the insert statement? Did the sql server error log give you more information? Could you at least post the

Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread helices via rsyslog
Done. Apparently, this issue happens mostly in the very early morning hours. It seems to be associated with the original issue in my original post: 2022-12-13T02:23:44.392947-06:00 hermes rsyslogd[2539]: action 'Sftp' (module 'ommysql.so') message lost, could not be processed. Check for

Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread Rainer Gerhards via rsyslog
I would probably make sense to create a debug log, at least for startup, to show what actually happened. Doc: https://www.rsyslog.com/doc/master/troubleshooting/howtodebug.html Rainer El mar, 13 dic 2022 a las 15:00, helices () escribió: > > No, it still rate-limits. I verified that the restart

Re: [rsyslog] Rsyslogd/ommysql.so: Not writing to DB intermittently

2022-12-13 Thread helices via rsyslog
No, it still rate-limits. I verified that the restart restarted rsyslogd: # systemctl -l status rsyslog * rsyslog.service - System Logging Service Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2022-12-12 13:58:40

Re: [rsyslog] Configuration of rsyslog to send to 2 remote servers and save into local file

2022-12-13 Thread Ludovic Hutin via rsyslog
Hi,     I have try rsyslog -N1 and all see good rsyslogd: version 8.2001.0, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: End of config validation run. Bye. And this is the rsyslog.conf file (i remove the #ligne) module(load="imuxsock") # provides support for

Re: [rsyslog] Configuration of rsyslog to send to 2 remote servers and save into local file

2022-12-13 Thread David Lang via rsyslog
we don't know what your default configuration is (that's set by the distro, not by us), so please post your full configs. that said, first check your config for errors (rsyslogd -N1), then enable impstats so that you can see the status of the different queues and outputs (to see if you are

[rsyslog] Configuration of rsyslog to send to 2 remote servers and save into local file

2022-12-13 Thread Ludovic Hutin via rsyslog
Hi,     I have a question that i don't find any answer on google, or i miss something.     I want to forward logs to 2 remote servers + save log into local file.     For multiple remote i do that in the /etc/rsyslog.d/10-remote.conf     # Centralized_SYSLOG     auth,authpriv.*