Hi, rsyslog.conf (identical on old and new system):
module(load="immark") module(load="imuxsock") module(load="imklog") *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log mail.info /var/log/maillog lpr.info /var/log/lpd-errs ftp.info /var/log/xferlog cron.* /var/log/cron *.=debug /var/log/debug.log test (on both old and new system): # logger test This happens for all messages, not only the ones I send with logger. e.g. /var/log/cron 2019-01-31T00:15:12.850021+01:00 server1 1 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic daily' completed (mailing output) I've also tested this with the simplest of rsyslog.conf I could think which was 1 line: *.* /var/log/all.log This also gave the same problem. These FreeBSD-servers runs several jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test 8.1901.0) all jails and main system experience the issue. Nick On Thu, 31 Jan 2019 at 16:47, John Chivian <[email protected]> wrote: > > More information is needed to say for sure, but your test message comes > before the blank message making me think it's a double line feed issue > at input. > > How did you generate that message? What does your rsyslog.conf look like? > > On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote: > > Hi, > > > > just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with > > rsyslog 8.40. Same rsyslog.conf but on the new server I get messages > > like this: > > > > 2019-01-31T13:13:28.489805+01:00 server2 > > 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test > > Old server shows: > > > > 2019-01-31T13:14:39.322311+01:00 kzk root: test > > > > Any idea why this is? What has changed and how do I get rid of the > > double timestamp/host? > > > > Nick > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. -- _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
