[rsyslog-notify] Forum Thread: Multine log transfert to another rsyslog server - (Mode 'edit_topic')

[noreply at adiscon.com]

User: raphaelk 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26320#p26320

Message: 
----------
Hi,
I encounter an issue with multiline log. We have a server, with rails app.
It generate multiline error log in rsyslog. Locally, In the rsyslog files,
I have the multi line log properly written : 

[code]
Feb  2 17:33:19 server app-unicorn[608]: ActionController::RoutingError (No
route matches "/fr/pulse/graphics/data/9658" with {:method=>:get}):
  <internal:prelude>:10:in `synchronize'
  raindrops (0.11.0) lib/raindrops/middleware.rb:118:in `call'
 
/usr/local/rvm/gems/ruby-1.9.3-p550 at app/gems/unicorn_metrics-0.2.1/lib/unicorn_metrics/middleware.rb:22:in
`block in call'
  unicorn (4.9.0) lib/unicorn/http_server.rb:674:in `worker_loop'
  unicorn (4.9.0) lib/unicorn/http_server.rb:529:in `spawn_missing_workers'
  unicorn (4.9.0) bin/unicorn_rails:209:in `<top (required)>'
  /usr/local/rvm/gems/ruby-1.9.3-p550 at app/bin/unicorn_rails:19:in `load'
  /usr/local/rvm/gems/ruby-1.9.3-p550 at h2ts/bin/unicorn_rails:19:in `<main>'
 
/usr/local/rvm/gems/ruby-1.9.3-p550 at global/bin/ruby_executable_hooks:15:in
`eval'
 
/usr/local/rvm/gems/ruby-1.9.3-p550 at global/bin/ruby_executable_hooks:15:in
`<main>'
[/code]

 These log are forwarded to a remote rsyslog server for further processing.
On the remote rsyslog server side, the multiline log "format" is "broken".
I mean, each line of the multiline are traited as a new log line.

Here what I have in the remote rsyslog log file

[code]
Feb  2 17:34:13 server h2ts-unicorn[608]: ActionController::RoutingError
(No route matches "/fr/pulse/graphics/data/9658" with {:method=>:get}):
Feb  2 17:34:13 server   <internal:prelude>:10:in `synchronize'
Feb  2 17:34:13 server   raindrops (0.11.0)
lib/raindrops/middleware.rb:118:in `call'
Feb  2 17:34:13 server   
/usr/local/rvm/gems/ruby-1.9.3-p550 at app/gems/unicorn_metrics-0.2.1/lib/unicorn_metrics/middleware.rb:22:in
`block in call'
Feb  2 17:34:13 server    unicorn (4.9.0) lib/unicorn/http_server.rb:674:in
`worker_loop'
Feb  2 17:34:13 server    unicorn (4.9.0) lib/unicorn/http_server.rb:529:in
`spawn_missing_workers'
Feb  2 17:34:13 server   unicorn (4.9.0) bin/unicorn_rails:209:in `<top
(required)>'
Feb  2 17:34:13 server   
/usr/local/rvm/gems/ruby-1.9.3-p550 at app/bin/unicorn_rails:19:in `load'
Feb  2 17:34:13 server   
/usr/local/rvm/gems/ruby-1.9.3-p550 at app/bin/unicorn_rails:19:in `<main>'
Feb  2 17:34:13 server   
/usr/local/rvm/gems/ruby-1.9.3-p550 at global/bin/ruby_executable_hooks:15:in
`eval'
Feb  2 17:34:13 server   
/usr/local/rvm/gems/ruby-1.9.3-p550 at global/bin/ruby_executable_hooks:15:in
`<main>'
[/code]

The rsyslog conf file contains :
[code]
$EscapeControlCharactersOnReceive off
[/code]

I tryed this too

[code]
$TCP_FRAMING to octet-counted but with no success.
[/code]

I use template to put log in dedicated files and to forward to remote
server ;
[code]
if $programname contains "XXXXXXX" and $syslogseverity > '4' then {
 action (type="omfile" dynaFile="logmessage_XXXXXXX")
 *.* @@XXXXXXXXX
 stop
}
[/code]

Any Idea ?
Your expertise would be appreciated :]