[rsyslog-notify] Forum Thread: Re: Uncompression of a message failed, cannot enable debug - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24847#p24847

Message: 
----------
rsyslog has an option to compress the messages, and when it does so it uses
a 'z' as the first character in the message (normally this should be a '<')

If you have something sending logs to rsyslog that are malformed, they can
trigger this.

If you log using the RSYSLOG_DebugFormat, you can see what systems are
sending malformed messages.

It could also be that something is sending very long messages, and the
messages are getting split by length, and the remainder of a message is
starting with 'z'

when you look at the rawlog field in the debugformat output, you should be
able to see what's going on (I don't think it will show the failed
'compressed' messages, but it should show enough for you to figure out
what's going on)