I'd have to check over the network. Will get back to you on that. I've installed 8.35 and the problem persists so that leads me to think it's a change on FreeBSD. Configure a RPI with Debian and rsyslogd to forward messages to a FreeBSD rsyslogd. Using the same method (logger test) I get the correctly formatted messages in /var/log/messages.
So all points to some change in FreeBSD 12. N. On Thu, 31 Jan 2019 at 17:39, John Chivian <[email protected]> wrote: > > Interesting. I have no experience with FreeBSD but you seem to have > eliminated any configuration issue. Does the same thing happen if you > output an event stream over the network? I ask because rsyslog applies > different templates to different output types and now I'm wondering if > the file output template is off. > > Regards, > > > On 1/31/19 10:13 AM, Nick Rosier via rsyslog wrote: > > Hi, > > > > rsyslog.conf (identical on old and new system): > > > > module(load="immark") > > module(load="imuxsock") > > module(load="imklog") > > > > *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err > > /var/log/messages > > security.* > > /var/log/security > > auth.info;authpriv.info > > /var/log/auth.log > > mail.info > > /var/log/maillog > > lpr.info > > /var/log/lpd-errs > > ftp.info > > /var/log/xferlog > > cron.* > > /var/log/cron > > *.=debug > > /var/log/debug.log > > > > test (on both old and new system): # logger test > > > > This happens for all messages, not only the ones I send with logger. > > e.g. /var/log/cron > > > > 2019-01-31T00:15:12.850021+01:00 server1 1 > > 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic > > daily' completed (mailing output) > > > > I've also tested this with the simplest of rsyslog.conf I could think > > which was 1 line: > > *.* /var/log/all.log > > > > This also gave the same problem. These FreeBSD-servers runs several > > jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly > > with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test > > 8.1901.0) all jails and main system experience the issue. > > > > Nick > > > > On Thu, 31 Jan 2019 at 16:47, John Chivian <[email protected]> wrote: > >> More information is needed to say for sure, but your test message comes > >> before the blank message making me think it's a double line feed issue > >> at input. > >> > >> How did you generate that message? What does your rsyslog.conf look like? > >> > >> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote: > >>> Hi, > >>> > >>> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with > >>> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages > >>> like this: > >>> > >>> 2019-01-31T13:13:28.489805+01:00 server2 > >>> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test > >>> Old server shows: > >>> > >>> 2019-01-31T13:14:39.322311+01:00 kzk root: test > >>> > >>> Any idea why this is? What has changed and how do I get rid of the > >>> double timestamp/host? > >>> > >>> Nick > >>> _______________________________________________ > >>> rsyslog mailing list > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > >>> http://www.rsyslog.com/professional-services/ > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >>> DON'T LIKE THAT. > >> > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > > > > > > -- > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. -- _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
