Hi
tl;dr
In rsyslog 8.2004.0 (also in the prior version) I'm having issues with
global option oversizemsg.input.mode. The output of a config check is:
rsyslogd -N 9
rsyslogd: version 8.2004.0, config validation run (level 9), master
config /etc/rsyslog.conf
rsyslogd: invalid or yet-unknown config file command
'oversizemsg.input.mode' - have you forgotten to load a module? [v8.2004.0
try https://www.rsyslog.com/e/3003 ]
Now for the long version. This happens when I set the following in my
rsyslog.conf
$oversizemsg.input.mode accept
It also doesn't work when I try it without the $-sign like so
"oversizemsg.input.mode accept" but then the config check outputs this:
rsyslogd -N 9
rsyslogd: version 8.2004.0, config validation run (level 9), master
config /etc/rsyslog.conf
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line
54: warnings occured in file '/etc/rsyslog.conf' around line 54 [v8.2004.0
try https://www.rsyslog.com/e/2207 ]
rsyslogd: unknown priority name "input.mode" [v8.2004.0]
According to this site:
https://www.rsyslog.com/doc/v8-stable/rainerscript/global.html?highlight=oversizemsg%20input%20mode
this should be a global option. Nevertheless I tried setting this option
in the imudp Input string but that is also not accepted by rsyslog.
The config is also invalid if I try it with "split" or "truncate" instead
of "accept".
In case you are interested in why I want to try this option. I'm using the
following template that creates a folder per host which sends messages:
string="/var/log/remotelogs/%HOSTNAME%/%syslogfacility-text%-%$YEAR%%$MONTH%%$DAY%.log"
Unfortunately I get a lot of logs from ESXi systems that seem to be
oversized. It appears as if those logs are then split and this leads to
some random string from the logmessage being in the splited-off message
part in the field where the hostname should be. Then rsyslog recognizes
that random string as the hostname and creates a folder with that random
string in the name with a file in it with just that splitted-off part of
the message.
Best,
Cyril
--
Universität Zürich
Cyril Stoll
Zentrale Informatik
Stampfenbachstrasse 73
CH-8006 Zürich
Tel. +41 44 63 5 22 93
www.zi.uzh.ch
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
