0

I run rsyslog in the debugg mode (-dn) and I show this logs :

    0153.213242514:main thread    : nsd_ptcp.c: We could initialize 1 TCP listen sockets out of 2 we received - this may or may not be an error indication.
    0153.215776512:main thread    : net.c: We could initialize 1 UDP listen sockets out of 2 we received - this may or may not be an error indication.
    0153.218166036:main thread    : net.c: We could initialize 1 UDP listen sockets out of 2 we received - this may or may not be an error indication.


0183.411735751:imudp.c        : parser.c: dropped LF at very end of message (DropTrailingLF is set)
0183.411809598:imudp.c        : parser.c: dropped LF at very end of message (DropTrailingLF is set)
0183.411869286:imudp.c        : parser.c: dropped LF at very end of message (DropTrailingLF is set)

The configuration is :

rsyslog.conf :

module(load="imuxsock")
module(load="imjournal")
module(load="imtcp")
module(load="imudp")
global(workDirectory="/var/lib/rsyslog")
include(file="/etc/rsyslog.d/*.conf")
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

rsyslog.d/test.conf :

template(name="test_template" type="string" string="/data/%FROMHOST-IP%.log")
ruleset(name="test_device"){
                action(type="omfile" dynaFile="test_template")
                action(type="omfwd" protocol="udp" target="10.0.0.1" port="1514")
}
input(type="imudp" port="1514" ruleset="test_device")

It's rsyslog 8.37 on CentOS8 with ~900messages per second.

The problem is that rsyslog stop forwarding randomly after a few seconds / minutes / hours

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.