Re: [rsyslog] Ubuntu 16 rsyslogd not creating log files

2017-11-09 Thread deoren
On November 9, 2017 10:21:04 PM CST, dchappelle via rsyslog wrote: >Apologies for not including the config. Here is >/etc/rsyslog.d/10-example.conf: > >dchappelle@L164:/etc/rsyslog.d$ cat 10-example.conf >local0.* /var/log/test.log >& stop > >The actual is

Re: [rsyslog] Ubuntu 16 rsyslogd not creating log files

2017-11-09 Thread dchappelle via rsyslog
Apologies for not including the config. Here is /etc/rsyslog.d/10-example.conf: dchappelle@L164:/etc/rsyslog.d$ cat 10-example.conf local0.*/var/log/test.log & stop The actual issue here looks to be a permissions issue. The syslog user does not have permis

Re: [rsyslog] Ubuntu 16 rsyslogd not creating log files

2017-11-09 Thread deoren
On November 9, 2017 6:47:11 PM CST, dchappelle via rsyslog wrote: >I am running a vanilla install of Ubuntu 16 and my rsyslogd is not >creating >new log files for me. I added a new filter rule and restarted rsyslogd. >After doing so and generating log messages for that rule, the target >log >fi

Re: [rsyslog] Ubuntu 16 rsyslogd not creating log files

2017-11-09 Thread David Lang
first off, there are two ubuntu 16 releases 16.04 (April) and 16.10 (October), I'm guessing you are running the 16.04 LTS release nothing in the config you are showing attempts to output to a file, please include the part of the config that shows what you are trying to write to. Rsyslog doesn

[rsyslog] Ubuntu 16 rsyslogd not creating log files

2017-11-09 Thread dchappelle via rsyslog
I am running a vanilla install of Ubuntu 16 and my rsyslogd is not creating new log files for me. I added a new filter rule and restarted rsyslogd. After doing so and generating log messages for that rule, the target log file is not created. If I manually create the file my log messages are then lo

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Scot Kreienkamp
Yep, Rainer confirmed that I can go into the megabytes in size; I had mine set to 128k as I had read somewhere in the mail archive that was the max. Or maybe it was the max for RELP, not sure as that was at least a year ago. Either way, I don't use RELP so I'm at 4 megs now and it shouldn't be

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread David Lang
On Thu, 9 Nov 2017, Scot Kreienkamp wrote: I have no plans to use RELP so I'll try setting it to 2 meg then. That should give it plenty of overhead, more than enough to resolve it for now. I have no control over the message size, it's whatever Oracle spits out. what you can do is have Oracl

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread David Lang
increase the max message size so that the messages don't get split? what is the source of the messages? (TCP, UDP, imfile, etc) David Lang On Thu, 9 Nov 2017, Scot Kreienkamp wrote: Hi David, Any ideas on any way to get around this if there's no way to preserve the metadata on an oversized

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread deoren
The current documentation[1] mentions that 8K is the default value for the maxmessagesize global parameter. The documentation[2] for imrelp mentions that the 'MaxDataSize' parameter defaults to the global message size, though it isn't 100% clear to me whether that is referring to the maxmessag

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Rainer Gerhards
2017-11-09 17:33 GMT+01:00 Scot Kreienkamp : > I have no plans to use RELP so I'll try setting it to 2 meg then. That > should give it plenty of overhead, more than enough to resolve it for now. I > have no control over the message size, it's whatever Oracle spits out. > > The limits for rsyslo

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Scot Kreienkamp
I have no plans to use RELP so I'll try setting it to 2 meg then. That should give it plenty of overhead, more than enough to resolve it for now. I have no control over the message size, it's whatever Oracle spits out. The limits for rsyslog and relp would be good info to add to the docu. Tha

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Rainer Gerhards
larger 128k currently seems to be a problem when RELP is used. Otherwise, we have configs which actually have set it to a couple of MB (and occasionally use it). Rainer 2017-11-09 17:25 GMT+01:00 deoren : > On 11/9/2017 10:24 AM, Scot Kreienkamp wrote: >> >> I have it set at 128k now... I thought

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread deoren
On 11/9/2017 10:24 AM, Scot Kreienkamp wrote: I have it set at 128k now... I thought I read in the list archives that was the maximium value? https://github.com/rsyslog/rsyslog/issues/1741 Looks like it (for now). ___ rsyslog mailing list http://li

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Scot Kreienkamp
I have it set at 128k now... I thought I read in the list archives that was the maximium value? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Scot Kreienkamp
Nope, just using TCP as the transport, nothing additional like RELP. Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com -Original Message- From:

Re: [rsyslog] ommysql database queue bottleneck

2017-11-09 Thread Steven Libby via rsyslog
> if you have > > start transaction > insert > insert > insert > end transaction > > that should be almost as fast as > > insert into ... values(),(),() > > and wildly faster than just > > insert > insert > insert > (no transaction defined) > > If this isn't true, then we need to modify the o

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread deoren
On 11/9/2017 9:00 AM, Rainer Gerhards wrote: 2017-11-09 14:46 GMT+01:00 Scot Kreienkamp : Hi David, Any ideas on any way to get around this if there's no way to preserve the metadata on an oversized message? You need to increase the message size. It's a simple config parmater [global(maxmess

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Rainer Gerhards
2017-11-09 14:46 GMT+01:00 Scot Kreienkamp : > Hi David, > > Any ideas on any way to get around this if there's no way to preserve the > metadata on an oversized message? You need to increase the message size. It's a simple config parmater [global(maxmessagesize="xx")] I mean. Rainer > > > Scot

Re: [rsyslog] Legacy FWD Failes on startup (v8)

2017-11-09 Thread deoren
On 11/9/2017 4:08 AM, Thomas Deutschmann via rsyslog wrote: Hi, no distribution will probably _require_ network for rsyslog per default because in the default configuration distributions are shipping, no network is required. Due to the fact that most init systems nowadays support parallel invoca

Re: [rsyslog] preserving metadata on message split

2017-11-09 Thread Scot Kreienkamp
Hi David, Any ideas on any way to get around this if there's no way to preserve the metadata on an oversized message? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreie

Re: [rsyslog] Legacy FWD Failes on startup (v8)

2017-11-09 Thread Rainer Gerhards
Just my 2cts quickly: I fully agree we need more tests/code review especially on the DNS requery part. It's just so many things on the todo list. I work very intensely on rsyslog since a couple of weeks again, but I can't do anything. So one needs to either wait or contribute (no bashing, just desc

Re: [rsyslog] Legacy FWD Failes on startup (v8)

2017-11-09 Thread Thomas Deutschmann via rsyslog
Hi, no distribution will probably _require_ network for rsyslog per default because in the default configuration distributions are shipping, no network is required. Due to the fact that most init systems nowadays support parallel invocation it isn't that easy to depend on a working network setup.