MonitorWare Knowledge Base

[kpawson]

Hi

I've got phpLogCon running on 2 servers and all is great and has been for almost 2 years, however I just installed another on a different network and I'm getting this error:

Uncompression of a message failed with return code -3 - enable debug logging if you need further information. Message ignored.

Have enabled debug in phpLogCon and this is what the debug window states from this message:

LogStreamDB|CreateMainSQLQuery: Created SQL Query:
SELECT SQL_CALC_FOUND_ROWS id, devicereportedtime, fromhost, infounitid, facility, priority, syslogtag, eventid, eventlogtype, eventsource, eventcategory, eventuser, message FROM SystemEvents WHERE id <= 107582 ORDER BY id DESC LIMIT 100

I do have rsyslog configured for TCP receive but everything is the same as my other installs and they don't get this error.

System is Debian 5 running MySQL and phpLogCon version 2.6.4

Any ideas or help would be appreciated.

Thanks
Keith

[kpawson]

Anyone or is this something obvious that I've missed.

[kpawson]

I've upgraded to 2.81 and checked everything in my rsyslog configuration and still get this error.
Is this more of Rsyslog issue or phpLogCon issue?

The other devices sending syslog data are not getting this error message, just the host of phpLogCon that's reporting it.

As previously mentioned I'm running two other installations of phpLogCon with rsyslog on different hardware/network and have never received these errors.

Any comments Andre or Rainer?

[alorbach]

is this error from rsyslog or phpLogCon?

Uncompression of a message failed with return code -3 - enable debug logging if you need further information. Message ignored.

From the phpLogCon point of view, I can't see any problems so far. Is this all debug output you get? Perhaps you can attach a screenshot to this post?

best regards,
Andre Lorbach

[kpawson]

Thanks for replying Andre - Not sure what you mean if the error is from rsyslog or phpLogCon, the error is displayed in phpLogCon from the rsyslog server hosting phpLogCon - the screen shots below should hopefully help.
Thanks

phplogcon-1.jpg (129.76 KiB) Viewed 99 times

phplogcon-2.jpg (116.87 KiB) Viewed 99 times

[alorbach]

Hi,

this error is within the syslog data, so its rsyslog related. My guess is that there is a zlib compression problem on the rsyslog receiver or sender side.

best regards,
Andre Lorbach

[kpawson]

Thanks Andre

I don't see any errors on the server in any logs regarding zlib or compression that can point me to what the issue could be. I've since updated rsyslog manually to 5.4 and still get the issue.

It's really weird as I've gone over all the configuration and versions of my two other rsyslog/phplogcon servers and don't see anything.

I guess I can just ignore it, but not sure if that's a good idea?

[rgerhards]

This rsyslog message means that rsyslog received a message that looked like it was compressed, but it failed for some reason. The only way to get to more details is run rsyslogd with a debug log enabled, while such a message comes in -- I guess that's not easy in your case. First of all, you would need to identify how to make such a message come in. If that's the only occurrence, it may have been a malformed message and you can ignore it. If it happens frequently, I'd suggest to hunt for the root cause.