Transaction Log "bs" Entry When "sb" Is Expected (Doc ID 2455475.1)

Last updated on MARCH 18, 2019

Applies to:

Symptoms

Referring to documentation on Store Transaction Log Format,  the section about the 'co' records has an 'sb' field:

The problem is that "bs=" in the "se" records, rather than "sb=" is being seen.

Here is an example:

This query finds none:

index=email_core sourcetype=email_transaction_store "<se " sb=*

And this query finds many:

index=email_core sourcetype=email_transaction_store "<se " bs=*

Example:

<se ts="2018-10-03T08:33:16.293-07:00" sn="imapd" pi="18058" si="5886248" ma="user/<USERID>/Drafts" mc="0" sf="UC" bs="231" td="1118"/>

It is expected that what is documented should be consistent with what is being shown in the transaction log file.

Changes

Cause