Reading through older threads I realize that if an application uses a non-standard frame delimiter then Rsyslog will have issues parsing the message but I am running 7.4.0 and bad delimiters are causing rsyslog to crash.
rsyslogd -v rsyslogd 7.4.0, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes I don't think a crash is the expected behaviour if the input is bad. Right? Here's the snippet from debug log just before crash. Oddly, I don't see a coredump or error causing the crash. 2367.362924601:7f4981e46700: parse using parser list 0x7f4987d93ed0 (the default list). 2367.362927457:7f4981e46700: Parser 'rsyslog.rfc5424' returned -2160 2367.362930309:7f4981e46700: Message will now be parsed by the legacy syslog parser (one size fits all... ;)). 2367.362932512:7f4981e46700: Parser 'rsyslog.rfc3164' returned 0 2367.362934756:7f4981e46700: msg parser: flags 30, from '192.168.1.100', msg '06/20/13,10:47:32,DNS Update Suc' 2367.362936776:7f4981e46700: parse using parser list 0x7f4987d93ed0 (the default list). 2367.362938676:7f4981e46700: Parser 'rsyslog.rfc5424' returned -2160 2367.362940448:7f4981e46700: Message will now be parsed by the legacy syslog parser (one size fits all... ;)). 2367.362943712:7f4981e46700: Parser 'rsyslog.rfc3164' returned 0 2367.362945989:7f4981e46700: msg parser: flags 30, from '192.1.35.77', msg 'cessful,192.1.236.14,mydesktop.internal .acme.com,,^M' 2367.362948017:7f4981e46700: parse using parser list 0x7f4987d93ed0 (the default list). 2367.362950143:7f4981e46700: Parser 'rsyslog.rfc5424' returned -2160 2367.362957428:7f4981e46700: Message will now be parsed by the legacy syslog parser (one size fits all... ;)). 2367.362960059:7f4981e46700: Parser 'rsyslog.rfc3164' returned 0 2367.362962370:7f4981e46700: processBatch: batch of 32 elements must be processed 2367.362969230:7f4981e46700: processBatch: batch of 31 elements must be processed 2367.362971685:7f4981e46700: scriptExec: batch of 31 elements, active (nil), active[0]:1 2367.362973524:7f4981e46700: SET $!vendor = 2367.362979077:7f4981e46700: function 'field' (id:9, params:3) 2367.362987082:7f4981e46700: var '$msg' 2367.362995144:7f4981e46700: 124 2367.363002241:7f4981e46700: 2 2367.363010228:7f4981e46700: END SET 2367.363015200:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363018158:7f4981e46700: rainerscript: executing function id 9 2367.363020318:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363022988:7f4981e46700: rainerscript: var '$msg': '58:55,Renew,192.168.24.114,,A46706750769,#015' 2367.363025227:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363028220:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363030789:7f4981e46700: field() field requested 2, field found 1 2367.363034649:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363036629:7f4981e46700: rainerscript: executing function id 9 2367.363038628:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363042128:7f4981e46700: rainerscript: var '$msg': '58:56,DNS Update R' 2367.363044246:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363046355:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363048399:7f4981e46700: field() field requested 2, field found 1 2367.363052521:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363054698:7f4981e46700: rainerscript: executing function id 9 2367.363056733:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363059297:7f4981e46700: rainerscript: var '$msg': '' 2367.363061436:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363064501:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363066812:7f4981e46700: field() field requested 2, field found 1 2367.363070008:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363071969:7f4981e46700: rainerscript: executing function id 9 2367.363073964:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363076230:7f4981e46700: rainerscript: var '$msg': '' 2367.363079524:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363081625:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363083776:7f4981e46700: field() field requested 2, field found 1 2367.363086818:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363088738:7f4981e46700: rainerscript: executing function id 9 2367.363091847:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363094538:7f4981e46700: rainerscript: var '$msg': '58:56,Renew,192.168.1.5,xxx00152B2xxxxx.internal.acme.com ,00152B2xxxxx,#015' 2367.363096786:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363098757:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363100873:7f4981e46700: field() field requested 2, field found 1 2367.363105195:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363107179:7f4981e46700: rainerscript: executing function id 9 2367.363109144:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363111404:7f4981e46700: rainerscript: var '$msg': '58:56,DNS Update Suc' 2367.363114652:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363116788:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363118820:7f4981e46700: field() field requested 2, field found 1 2367.363121742:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363124771:7f4981e46700: rainerscript: executing function id 9 2367.363126849:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363129227:7f4981e46700: rainerscript: var '$msg': '' 2367.363131414:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363133378:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363141411:7f4981e46700: field() field requested 2, field found 1 2367.363144986:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363147022:7f4981e46700: rainerscript: executing function id 9 2367.363148985:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363152448:7f4981e46700: rainerscript: var '$msg': '47:28,DNS Update R' 2367.363154621:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363156703:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363158679:7f4981e46700: field() field requested 2, field found 1 2367.363161735:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363164816:7f4981e46700: rainerscript: executing function id 9 2367.363166929:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' 2367.363169277:7f4981e46700: rainerscript: var '$msg': '' 2367.363171380:7f4981e46700: eval expr 0x7f4987da4810, type 'N[78]' 2367.363173383:7f4981e46700: eval expr 0x7f4987da4cc0, type 'N[78]' 2367.363176540:7f4981e46700: field() field requested 2, field found 1 2367.363179769:7f4981e46700: eval expr 0x7f4987da4770, type 'F[70]' 2367.363181745:7f4981e46700: rainerscript: executing function id 9 2367.363183836:7f4981e46700: eval expr 0x7f4987da4870, type 'V[86]' TIA _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
