On Fri, 22 Jan 2016, Chaloulos, Klearchos (Nokia - GR/Athens) wrote:
Thanks, the hint about the message beginning with the letter z helped a lot.
The error "Uncompression of a message failed with return code -3" is generated
by the rsyslog instance on the master node. It seems that messages get mixed up or
truncated during the forwarding:
2016-01-22T19:15:14.150225+02:00 MN rsyslogd: Uncompression of a message failed
with return code -3 - enable debug logging if you need further information.
Message ignored. [v8.10.0]
2016-01-22T19:15:14.150201+02:00 zing cgroup subsys cpuset
As you can see above, the kernel log "Initializing cgroup subsys cpuset" was cut, and the
part "zing cgroup subsys cpuset" arrived separately. Since it starts with a z, it causes
this error to appear.
The template we use for forwarding is:
template(name="ForwardFormat" type="string"
string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME%
%syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n")
I am concerned about the '\n' at the end. I removed it and forwarding worked
OK. Do you think it is causing problems?
Do you see anything else suspicious in the template?
Also the forwarding is done in an awkward way:
if ( $syslogfacility-text == 'auth' or $syslogfacility-text == 'authpriv' )
then @@Log:1025;ForwardFormat
# warning or higher level logs are forwarded to master syslog
*.warn @@Log:1025;ForwardFormat
# rest of logs go to master-syslog
*.* @@Log:1025;ForwardFormat
From the above it seems that an auth.err log will be forwarded three times, as
forwarded logs are not dropped. Do you think this might cause this error?
I only see two forwards here. but yes, if you don't drop the log after you
forward it, it will get forwarded again.
you should have the newline at the end of the message.
the most common cause for chopped up messages is that the message is longer than
the maxmessagesize.
In old versions this was 1K, current versions have it set to 2K
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
