[syslog-ng] Trying to get json out of 3.7beta2
Russell Fulton
r.fulton at auckland.ac.nz
Tue Jul 7 23:00:50 CEST 2015
> As it seems, there are three cases where json-parser() drops messages:
> 1) a marker() option is specified and the message doesn't start with that value
> 2) json parse error, in which case an error is printed
> 3) if the top-level json object in the input is not an Object (but a list or a single value), but again an error message is printed in this case too
>
> I didn't see the marker option in your configuration, so either of the error cases should be logged as an internal message, at the error level.
Where should the errors get logged to? I have been looking for anything in /var/log/.
Do I need to add an log{} entry for the errors?
BTW This is a corporate managed RHEL box that runs rsyslog for ‘normal’ logging. I am running syslog-ng listening on non standard ports as I have done on other systems.
[rful011 at secmgrprd01 ~]$ sudo grep syslog /var/log/messages
Jul 6 12:04:15 secmgrprd01 syslog-ng[24493]: syslog-ng starting up; version='3.7.0beta2'
Jul 6 12:05:08 secmgrprd01 sudo[24497]: rful011 : TTY=pts/0 ; PWD=/usr/local ; USER=root ; COMMAND=/sbin/service syslog-ng stop
Jul 8 08:43:50 secmgrprd01 rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1523" x-info="http://www.rsyslog.com"] exiting on signal 15.
Jul 8 08:46:04 secmgrprd01 rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="12946" x-info="http://www.rsyslog.com"] start
Jul 8 08:52:27 secmgrprd01 supervise/syslog-ng[12924]: Daemon was killed, not restarting; exitcode=‘9’
What is odd is the I did not get start messages for the most recent restart and I am sure that it has been restarted many more times than twice in the last couple of days.
Russell
More information about the syslog-ng
mailing list