there is a max message size parameter that you can set in rsyslog, make
sure it's set long enough for your messages.
David Lang
On Thu, 19 Apr 2012, Florian Crouzat wrote:
Date: Thu, 19 Apr 2012 15:30:04 +0200
From: Florian Crouzat <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] Rsyslog splitting long-lines into multiple smaller one
Hi,
This is my first message to the list so please be kind ;)
For the short version of the question, go the bottom.
I'm using CentOS, my tests have been made using 5.6 with
rsyslog-3.22.1-3.el5_6.1 but I aim to install 6.2 with
rsyslog-4.6.2-12.el6.x86_64 ... Old version in both case yeah...
Java log through syslog using a syslog appender in log4j.
I emulated a standard log line format using a log4j pattern, and it works
just fine. Rsyslog add "timestamp %msg" and log4j add "hostname jboss:
blablabla...".
Eg: Apr 19 15:11:10 host.example.com jboss: INFO [ ]
[StandardPctxCacheExitHandler ] - handling standard transaction expiration
for cache id 06570496120419CJ4YAB1
I'm using a log analyser (ossec) who knows how to decode a jboss log when
matching its pattern, but with long-lines, it seems that something truncate
them and create multiple-lines. The first ends with "...".
It means that each splitted line isn't logged through log4j and doesn't have
the pattern I defined ==> I can't parse it, ossec goes crazy, and a bunch of
stuff don't work.
My question in short: is there a way to tell rsyslogd not to split my
long-lines into different smaller ones ?
I tried 3 different thing:
$template JbossFormattest1,"%timegenerated% %msg:0:$%\n"
$template JbossFormattest3,"%timegenerated% %msg:0:3000%\n"
$template JbossFormattest2,"%timegenerated% %msg:drop-cc:%\n"
Sadly, none of them worked.
I'm hoping for some ENV variables, and not to recompile changing a #define
and/or tweaking my kernel.
In the worst case, I'll extract my dynamic log4j pattern in a different
rsyslog templates per server as %HOSTNAME% would be localhost.localdomain.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
