[rsyslog-notify] Forum Thread: syslogtag sporadic match - (Mode 'post')

[noreply at adiscon.com]

User: skreienlzb 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26918#p26918

Message: 
----------
Hi everyone...

Hope someone can help me, I'm posting this as a last resort.  I have a
problem that I've never run into before despite having this log forwarder
setup for years and it working flawlessly until now.  

I am forwarding a text log that's being read in by imfile.  Here's the
forwarding config:
[code:2uufj8rx]
module(load="imfile") #needs to be done just once


ruleset(name="sitwls1acclog"){
        action(type="omfwd" Target="monvsyslog.na.lzb.hq"
Port="1524" Protocol="udp" queue.filename="TCP-Remote-sitwls1acclog"
queue.size="25000" queue.discardmark="20000"
queue.dequeuebatchsize="1024" queue.type="LinkedList")

}

input(type="imfile"
       
file="/opt/oracle/domains/sit_domain/servers/wls_auth_server1/logs/access.log"
        tag="sitwls1acclog:"
        facility="local6"
        PersistStateInterval="100"
        ruleset="sitwls1acclog"
)
[/code:2uufj8rx]


With this config I can verify the text is being forwarded, as proven by a
TCP dump.  I can also write a rule using fromhost-ip to dump everything
from that host to one file and I get all the expected output.  However, if
I match based on the syslogtag alone, it doesn't write the logs into the
files.  It seems to be sporadic.  Are there any limitations on the number
of if condition tests you can perform, or are there any other limitations
that might explain it?  Or any way to better write the receiver config that
I've attached other than 24 if statements?  Or any other ways to optimize
the config?  I'm sending over UDP temporarily, but normally use TCP.  I've
got impstats turned on and I sent them through the online analyzer which
isn't reporting back any problems.

I've attached my receiver file as it's somewhat lengthy.  

Thanks for any help anyone can offer.  This has worked well in the past, I
have no idea why it's breaking now.