I am using rsyslog to transfer log files from a client (ver. 8.24.0) to a server (ver. 5.8.10) via TCP. I have also configured rsyslog.conf in the server to append a hostname and date to a transferred log file name. $MaxMessageSize is unset (default). Now I am experiencing the following strange phenomena.
a. In the folder for transferred log files, I found log files with broken names like "ter-20190618.log" other than normal log files. Opening such a file, it says: > Jun 18 2019 14:17:00 ter errors will be ... The fifth word, quite often some truncated English word, in a log file seems to be taken as the /hostname/ in its file name. In addition, most of these files have very small size and usually only one line. b. Original logs in the client and tranferred logs in the server are different. Long lines in original logs are truncated; transferred logs can contain up to 2044 characters per line. c. Such a splited small log seems to have been generated when truncation occurred, and it contains a part of truncated messages. In this URL <http://rsyslog-users.1305293.n2.nabble.com/Long-line-can-t-understand-forward-truncation-reason-td7594369.html> , a similar issue was discussed even though it is not identical to mine. My questions are as follows. 1. Can truncation of a long message cause those split log files? If so, how can I fix this? 2. If not, what would be a cause of my probrems? 3. Will updating rsyslog on the server to ver. 8.24.0 fix / alleviate these problems? Any help will be much appreciated. With best regards, Tomoaki Hashizaki -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
