[rsyslog-notify] Forum Thread: Re: Strange linebreak with Jboss access logs - (Mode 'reply')

[noreply at adiscon.com]

User: Chriss.ko 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24270#p24270

Message: 
----------
Thanks for you very fast reply, it looks a bit better now:
all.log
[code:16zrbtzz]
Feb 27 18:11:45 0 Feb 27 18:11:49 devfe1 JB1access-log
JB1access-log  10.0.0.30 [27/Feb/2014:18:11:34
+0100] 0 HTTP/1.1 11001 http-executor-threads - 559 / 200 GET 2432
Feb 27 18:11:45 0 Feb 27 18:11:49 devfe1 JB1access-log
JB1access-log  10.0.0.30 [27/Feb/2014:18:11:34
+0100] 0 HTTP/1.1 11001 http-executor-threads - 560
/as7_style.css 200 GET 1707
Feb 27 18:11:45 0 Feb 27 18:11:49 devfe1 JB1access-log
JB1access-log  10.0.0.30 [27/Feb/2014:18:11:34
+0100] 0 HTTP/1.1 11001 http-executor-threads - 562
/as7_logo.png 200 GET 22866
Feb 27 18:11:45 0 Feb 27 18:11:49 devfe1 JB1access-log
JB1access-log  10.0.0.30 [27/Feb/2014:18:11:34
+0100] 0 HTTP/1.1 11001 http-executor-threads - 561
/jboss_community.png 200 GET 2731
Feb 27 18:11:45 0 Feb 27 18:11:49 devfe1 JB1access-log
JB1access-log  10.0.0.30 [27/Feb/2014:18:11:34
+0100] 0 HTTP/1.1 11001 http-executor-threads - 564 /bkg.gif
200 GET 51660[/code:16zrbtzz]

jboss-1-access.log:
[code:16zrbtzz]
Feb 27 18:13:39 devfe1 JB1access-log 10.0.0.30
[27/Feb/2014:18:13:25 +0100] 0 HTTP/1.1 11001
http-executor-threads - 566 / 200 GET 2432
Feb 27 18:13:39 devfe1 JB1access-log 10.0.0.30
[27/Feb/2014:18:13:25 +0100] 0 HTTP/1.1 11001
http-executor-threads - 563 /as7_style.css 200 GET 1707
Feb 27 18:13:39 devfe1 JB1access-log 10.0.0.30
[27/Feb/2014:18:13:25 +0100] 0 HTTP/1.1 11001
http-executor-threads - 567 /as7_logo.png 200 GET 22866
Feb 27 18:13:39 devfe1 JB1access-log 10.0.0.30
[27/Feb/2014:18:13:25 +0100] 0 HTTP/1.1 11001
http-executor-threads - 568 /jboss_community.png 200 GET 2731
Feb 27 18:13:39 devfe1 JB1access-log 10.0.0.30
[27/Feb/2014:18:13:25 +0100] 0 HTTP/1.1 11001
http-executor-threads - 570 /bkg.gif 200 GET 51660
[/code:16zrbtzz]

So the problem with the doubled "app-name" and the misslogged files in the
all.log is still there. 

I changed the server config to that: (to match the working config for
jboss-1-access.log)
[code:16zrbtzz]
$template AllPerHostLogs,"/cfn365/log/%FROMHOST%/all.log"
if \
        $source != 'adm' \
                and not ( \
        $app-name contains 'TC1catalina-out' \
                or \
        $app-name contains 'TC1access-log' \
                or \
        $app-name contains 'JB1access-log' \
                ) \
then -?AllPerHostLogs[/code:16zrbtzz]

But nothing has changed. :?

Btw: Is there any good resource where all the magic with the $app-name,
$hostname, $sendername etc is explained? The docu on
"http://www.rsyslog.com/doc/v5-stable/" is not so transparent to me. :(
I had the problem that a had some logfiles coming from the kernel with the
$hostname filled with the hostname, the logs from the tomcat came with the
FQDN, so I decided to change all the the $sendername and it is working, but
the behaviour looks a bit weird to me.

Regards,

Chriss