I don't know PHP much, but just to rule out a possible buffering issue with your script (either when reading from stdin, or when writing to the file), I would suggest trying with a simple bash script instead, something like this:
https://github.com/rsyslog/rsyslog/blob/master/tests%2Ftestsuites%2Fomprog-defaults-bin.sh (You can ignore lines from 5 to 9.) Regards Joan On Sun, Mar 23, 2025, 12:42 David Lang via rsyslog < rsyslog@lists.adiscon.com> wrote: > Alexey Rudenko-Desnyak wrote: > > > Unfortunately, I was hasty in my conclusion. I see the same problem > > even with the latest stable version rsyslogd 8.2502.0 (aka 2025.02) and > > updated omprog.so. omprog still loses messages. :( How this could > happen?.. > > do you have impstats data for the timeframe where you start losing > messages? > > We would need to see your full log configs. (wiht any included files). By > default Ubuntu is going to send your logs through journald before rsyslog > gets a > chance to work with them, so we need the impstats output to see what's > happening. > > can you confirm that if you just send the logs to a file rather than > through > omprog you do not lose any messages? > > David Lang > > > вс, 23 мар. 2025 г. в 06:38, David Lang <da...@lang.hm>: > > > >> Alexey Rudenko-Desnyak wrote: > >> > >>> > >>> VERSION. I have the latest version of rsyslog installed on Ubuntu: > >>> === > >>> rsyslogd -v > >>> rsyslogd 8.2112.0 (aka 2021.12) compiled with: > >>> PLATFORM: x86_64-pc-linux-gnu > >>> === > >> > >> that is from the end of 2021. If you cannot upgrade to a newer community > >> version, you will have to ask Ubuntu for assistance. Please upgrade to > at > >> least > >> 8.2412 if not to a 8.25xx version > >> > >> I would suggest that you setup impstats so that you can see how many > >> events are > >> being processed vs how many are being queued. > >> > >> David Lang > >> > >>> CONFIG. Config is minimal: > >>> === > >>> local5.info action( > >>> type="omprog" > >>> binary="/tmp/test.php" > >>> ) > >>> General configuration file contains only default settings. > >>> Option $RepeatedMsgReduction is either commented out or "off". > >>> === > >>> > >>> BINARY. Binary /tmp/test.php simply adds stdin input to "out.log" line > >> by > >>> line: > >>> === > >>> #!/usr/bin/php > >>> <?php > >>> $SyslogMessage = fgets(STDIN, 0x1000); > >>> file_put_contents('/tmp/out.log', $SyslogMessage, FILE_APPEND); > >>> === > >>> > >>> TEST1. I quickly send from keyboard 20 test messages: > >>> === > >>> logger -p local5.info "Test1!"<Enter> > >>> ... 20 times > >>> === > >>> The problem: in the output file I see ONLY 8 messages (!). > >>> === > >>> cat out.log > >>> 2025-03-23T05:26:15.075321-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:16.611209-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:18.161275-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:19.325636-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:20.476942-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:22.115802-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:23.236457-03:00 AlexeyPC alexey: Test1! > >>> 2025-03-23T05:26:24.804124-03:00 AlexeyPC alexey: Test1! > >>> === > >>> > >>> TEST2. Bash script sends 10 messages in a loop: > >>> === > >>> cat send_test_msg.sh > >>> #!/bin/bash > >>> for i in {1..10}; do logger -p local5.info "Test $i"; done > >>> === > >>> In the output file I see only the first message: > >>> === > >>> cat out.log > >>> 2025-03-23T05:44:40.592652-03:00 AlexeyPC root: Test 1 > >>> === > >>> Where is the rest and what is happening in general? > >>> Thank you a lot in advance!! > >>> > >>> P.S. If I set in config file "old style" program launching > >>> === > >>> local5.info ^/tmp/test.php > >>> === > >>> <?php > >>> $SyslogMessage = $_SERVER['argv'][1]; > >>> file_put_contents('/tmp/out.log', $SyslogMessage, FILE_APPEND); > >>> === > >>> - all functions perfectly, no message is lost. > >>> _______________________________________________ > >>> rsyslog mailing list > >>> https://lists.adiscon.net/mailman/listinfo/rsyslog > >>> http://www.rsyslog.com/professional-services/ > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >>> > >> > > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
