What you describe indicates that the sender does not sent with TLS enabled.
Check which clients experience the issue and double check their TLS configuration. Rainer Sent from phone, thus brief. Killian, Edward [USA] via rsyslog <rsyslog@lists.adiscon.com> schrieb am Mi., 9. Apr. 2025, 22:57: > We have a rsyslog server set up running rsyslog-8.2310.0-4 on Rocky Linux > 9.5. We have many clients to this server, some working OK with tls and a > few not. The systems working OK are running rsyslog-8.2102.0-15 on Rocky > Linux-8. All are using the same CA file with each having their own cert and > key files. I also have systems running Debian-11 and Debian-12 that are > having the same tls problem. The log file from a system with the issue > looks like: > > Apr 9 16:08:29 steuben.int.griffiss.us > #011SKu#034=�#025*#025�#000�#000ʨ��gO�T#006<�^�#031�#026#000#005#000#005#001#000#000#000#000#000#034#000#002@ > #001#000#013#000#002#001#000#000-#000#003#002#001#000�#001#000#001#000#000#026#000#000 > > If I set $ActionSendStreamDriverMode to 0 then the issue go away and it > looks like a normal log file. But if it is set to 1 the issue is present. > > This has been driving me nuts all day. Let me know if you need more info. > > Edward Killian > Systems Engineer - Lead Engineer > Global Defense Group > > killian_edw...@bah.com > > Booz | Allen | Hamilton > BoozAllen.com<https://www.boozallen.com/> > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
