Found this: https://svnweb.freebsd.org/base/head/UPDATING?r1=332100&r2=332099&pathrev=332100
76 When using rsyslog, disable the 'SysSock.UseSpecialParser' option 77 of the 'imuxsock' module to let messages be processed by the 78 regular RFC 3164/5424 parsing pipeline: 79 80 module(load="imuxsock" SysSock.UseSpecialParser="off") Guess this is a workaround which should be fixed in the code? On Thu, 31 Jan 2019 at 18:10, Nick Rosier <[email protected]> wrote: > > I'd have to check over the network. Will get back to you on that. > > I've installed 8.35 and the problem persists so that leads me to think > it's a change on FreeBSD. Configure a RPI with Debian and rsyslogd to > forward messages to a FreeBSD rsyslogd. Using the same method (logger > test) I get the correctly formatted messages in /var/log/messages. > > So all points to some change in FreeBSD 12. > > N. > > On Thu, 31 Jan 2019 at 17:39, John Chivian <[email protected]> wrote: > > > > Interesting. I have no experience with FreeBSD but you seem to have > > eliminated any configuration issue. Does the same thing happen if you > > output an event stream over the network? I ask because rsyslog applies > > different templates to different output types and now I'm wondering if > > the file output template is off. > > > > Regards, > > > > > > On 1/31/19 10:13 AM, Nick Rosier via rsyslog wrote: > > > Hi, > > > > > > rsyslog.conf (identical on old and new system): > > > > > > module(load="immark") > > > module(load="imuxsock") > > > module(load="imklog") > > > > > > *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err > > > /var/log/messages > > > security.* > > > /var/log/security > > > auth.info;authpriv.info > > > /var/log/auth.log > > > mail.info > > > /var/log/maillog > > > lpr.info > > > /var/log/lpd-errs > > > ftp.info > > > /var/log/xferlog > > > cron.* > > > /var/log/cron > > > *.=debug > > > /var/log/debug.log > > > > > > test (on both old and new system): # logger test > > > > > > This happens for all messages, not only the ones I send with logger. > > > e.g. /var/log/cron > > > > > > 2019-01-31T00:15:12.850021+01:00 server1 1 > > > 2019-01-31T00:15:12.849468+01:00 server1 fcron 7087 - - Job 'periodic > > > daily' completed (mailing output) > > > > > > I've also tested this with the simplest of rsyslog.conf I could think > > > which was 1 line: > > > *.* /var/log/all.log > > > > > > This also gave the same problem. These FreeBSD-servers runs several > > > jails all with rsyslog. On FreeBSD-11 rsyslog 8.35 all log correctly > > > with the same rsyslog.conf. On FreeBSD-12 rsyslog 8.40 (and just test > > > 8.1901.0) all jails and main system experience the issue. > > > > > > Nick > > > > > > On Thu, 31 Jan 2019 at 16:47, John Chivian <[email protected]> wrote: > > >> More information is needed to say for sure, but your test message comes > > >> before the blank message making me think it's a double line feed issue > > >> at input. > > >> > > >> How did you generate that message? What does your rsyslog.conf look like? > > >> > > >> On 1/31/19 7:29 AM, Nick Rosier via rsyslog wrote: > > >>> Hi, > > >>> > > >>> just moved from FreeBSD 11.1 with rsyslog 8.35 to FreeBSD 12 with > > >>> rsyslog 8.40. Same rsyslog.conf but on the new server I get messages > > >>> like this: > > >>> > > >>> 2019-01-31T13:13:28.489805+01:00 server2 > > >>> 2019-01-31T13:13:28.489558+01:00 server2 root 68878 - - test > > >>> Old server shows: > > >>> > > >>> 2019-01-31T13:14:39.322311+01:00 kzk root: test > > >>> > > >>> Any idea why this is? What has changed and how do I get rid of the > > >>> double timestamp/host? > > >>> > > >>> Nick > > >>> _______________________________________________ > > >>> rsyslog mailing list > > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >>> http://www.rsyslog.com/professional-services/ > > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > >>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > > >>> if you DON'T LIKE THAT. > > >> > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com/professional-services/ > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > >> DON'T LIKE THAT. > > > > > > > > > -- > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > > > -- -- _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
