Ooops... previous message's attachment was the config, not the debug output.
Debug attached.
On Sun, 11 Sep 2011 16:50:57 -0400
Steve Chupack <[email protected]> wrote:
> Hi,
>
> I have rsyslogd up and running and logging to mysql with loganalyzer as a
> front end. Very cool.
>
> However, I can't seem to get on-disk queuing working, which would be nice if
> mysql goes down or a table is locked because I'm purging records during a
> nightly maintenance cron.
>
> I never see any queue files created. I dropped the size of the memory queue
> to something ridiculously small, but still no queue files even after 20
> minutes.
>
> I followed the instructions given here:
> http://www.rsyslog.com/doc/rsyslog_high_database_rate.html along with a
> couple of other tutorials on rsyslogd and queuing.
>
> I'm quite sure I'm just completely missing something obvious. Details
> below... And thanks to anyone who might be able to point out what I'm doing
> wrong.
>
> -Steve
>
>
>
> MY CONFIG, please, no flames re the horrendously complex rules ;-)
>
> # if you experience problems, check
> # http://www.rsyslog.com/troubleshoot for assistance
>
> # rsyslog v3: load input modules
> # If you do not load inputs, nothing happens!
> # You may need to set the module load path if modules are not found.
>
> $ModLoad immark # provides --MARK-- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g. via
> logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
> $ModLoad ommysql
>
> # SC 2010.11.11: configure disk caching in case mysql is unavailable
>
> $MainMsgQueueSize 5
>
> $WorkDirectory /var/log/rsyslogq # default location for work (spool) files
>
> $ActionQueueType LinkedList # use asynchronous processing
> $ActionQueueFileName dbq # set file name, also enables disk mode
> $ActionResumeRetryCount -1 # infinite retries on insert failure
>
> # send snmpd INFO messages to the dustbin
>
> if $syslogseverity-text == 'info' and $syslogtag contains 'snmpd' then ~
>
> $template vtfw,"insert into vtfw (Message, Facility, FromHost, Priority,
> DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%',
> %syslogfacility%, '%HOSTNAME%', %syslogpriority%,
> '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%,
> '%syslogtag%')",SQL
>
> if ($fromhost-ip contains '10.128.255') then
> :ommysql:localhost,Syslog,root,mysqldb44;vtfw
> & ~
> #if ($fromhost-ip contains '10.128.255') then ~
>
> $template vt1hs1_switches,"insert into vt1hs1_switches (Message, Facility,
> FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)
> values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%,
> '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%,
> '%syslogtag%')",SQL
>
> if $fromhost-ip contains '10.128.0' or $hostname contains_i 'core01' or
> $hostname contains_i 'core02' then
> :ommysql:localhost,Syslog,root,mysqldb44;vt1hs1_switches
> #if ($fromhost-ip contains '10.128.0' or $source=='vt1hs1-dc216-core01' or
> $source=='vt1hs1-dc216-core02') then /var/log/switches
> & ~
> #if $fromhost-ip contains '10.128.0' or $hostname contains_i 'core01' or
> $hostname contains_i 'core02' then ~
>
> $template vt1hs1_wifi,"insert into vt1hs1_wifi (Message, Facility, FromHost,
> Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values
> ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%,
> '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%,
> '%syslogtag%')",SQL
>
> if $fromhost-ip contains '10.128.244' then
> :ommysql:localhost,Syslog,root,mysqldb44;vt1hs1_wifi
> & ~
> #if $fromhost-ip contains '10.128.244' then ~
>
> $template vt1hs1_vsphere,"insert into vt1hs1_vsphere (Message, Facility,
> FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)
> values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%,
> '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%,
> '%syslogtag%')",SQL
>
> if ($fromhost-ip == '10.128.24.40' or $fromhost-ip == '10.128.24.44' or
> $fromhost-ip == '10.128.24.48' or $fromhost-ip == '10.128.24.52' or
> $fromhost-ip == '10.128.24.72' or $fromhost-ip == '10.128.24.76' or
> $fromhost-ip == '10.128.24.80' or $fromhost-ip == '10.128.24.84') and
> ($syslogseverity-text == 'warning' or $syslogseverity-text == 'warn' or
> $syslogseverity-text == 'err' or $syslogseverity-text == 'error' or
> $syslogseverity-text == 'crit' or $syslogseverity-text == 'alert' or
> $syslogseverity-text == 'emergency' or $syslogseverity-text == 'panic') then
> :ommysql:localhost,Syslog,root,mysqldb44;vt1hs1_vsphere
> & ~
>
> if ($fromhost-ip == '10.128.24.40' or $fromhost-ip == '10.128.24.44' or
> $fromhost-ip == '10.128.24.48' or $fromhost-ip == '10.128.24.52' or
> $fromhost-ip == '10.128.24.72' or $fromhost-ip == '10.128.24.76' or
> $fromhost-ip == '10.128.24.80' or $fromhost-ip == '10.128.24.84') and
> ($syslogseverity-text == 'notice') then ~
>
>
> #*.* :ommysql:localhost,Syslog,root,mysqldb44
> *.notice :ommysql:localhost,Syslog,root,mysqldb44
>
> # Log all kernel messages to the console.
> # Logging much else clutters up the screen.
> #kern.* /dev/console
>
> # Log anything (except mail) of level info or higher.
> # Don't log private authentication messages!
> *.info;mail.none;authpriv.none;cron.none -/var/log/messages
>
> # The authpriv file has restricted access.
> authpriv.* /var/log/secure
>
> # Log all the mail messages in one place.
> mail.* -/var/log/maillog
>
>
> # Log cron stuff
> cron.* -/var/log/cron
>
> # Everybody gets emergency messages
> *.emerg *
>
> # Save news errors of level crit and higher in a special file.
> uucp,news.crit -/var/log/spooler
>
> # Save boot messages also to boot.log
> local7.* /var/log/boot.log
>
> # Remote Logging (we use TCP for reliable delivery)
> # An on-disk queue is created for this action. If the remote host is
> # down, messages are spooled to disk and sent when it is up again.
> #$WorkDirectory /rsyslog/spool # where to place spool files
> #$ActionQueueFileName uniqName # unique name prefix for spool files
> #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
> #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
> #$ActionQueueType LinkedList # run asynchronously
> #$ActionResumeRetryCount -1 # infinite retries if host is down
> # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
> #*.* @@remote-host:514
>
>
> # ######### Receiving Messages from Remote Hosts ##########
> # TCP Syslog Server:
> # provides TCP syslog reception and GSS-API (if compiled to support it)
> $ModLoad imtcp.so # load module
> $InputTCPServerRun 1470 # start up TCP listener at port 514
>
> # UDP Syslog Server:
> $ModLoad imudp.so # provides UDP syslog reception
> $UDPServerRun 514 # start a UDP syslog server at standard port 514
>
>
> SOME DEBUG OUTPUT:
>
> (see attached)
>
>
>
>
>
>
>
>
>
> Steve Chupack | IT Systems Administrator
> V: 877.327.8422 x 1242
> [email protected] | www.dealer.com
>
>
2299.735726000:2b73e241aa90: rsyslogd 4.6.6 startup, compatibility mode 4,
module path ''
2299.735792000:2b73e241aa90: caller requested object 'net', not found (iRet
-3003)
2299.735803000:2b73e241aa90: Requested to load module 'lmnet'
2299.735810000:2b73e241aa90: loading module '/usr/lib/rsyslog/lmnet.so'
2299.735900000:2b73e241aa90: module of type 2 being loaded.
2299.735910000:2b73e241aa90: source file conf.c requested reference for module
'lmnet', reference count now 1
2299.735918000:2b73e241aa90: rsyslog runtime initialized, version 4.6.6,
current users 1
2299.735934000:2b73e241aa90: source file syslogd.c requested reference for
module 'lmnet', reference count now 2
2299.736156000:2b73e241aa90: module of type 1 being loaded.
2299.736169000:2b73e241aa90: module of type 1 being loaded.
2299.736181000:2b73e241aa90: source file omfwd.c requested reference for module
'lmnet', reference count now 3
2299.736194000:2b73e241aa90: module of type 1 being loaded.
2299.736203000:2b73e241aa90: entry point 'doHUP' not present in module
2299.736210000:2b73e241aa90: module of type 1 being loaded.
2299.736218000:2b73e241aa90: entry point 'doHUP' not present in module
2299.736224000:2b73e241aa90: module of type 1 being loaded.
2299.736232000:2b73e241aa90: entry point 'doHUP' not present in module
2299.736239000:2b73e241aa90: module of type 1 being loaded.
2299.736246000:2b73e241aa90: entry point 'doHUP' not present in module
2299.736332000:2b73e241aa90: deque option f, optarg '/etc/rsyslog.conf'
2299.736342000:2b73e241aa90: Writing pidfile /var/run/rsyslogd.pid.
2299.736467000:2b73e241aa90: rsyslog 4.6.6 - called init()
2299.736476000:2b73e241aa90: Unloading non-static modules.
2299.736483000:2b73e241aa90: module lmnet NOT unloaded because it still has a
refcount of 3
2299.736489000:2b73e241aa90: Clearing templates.
2299.736598000:2b73e241aa90: cfline: '$ModLoad immark # provides --MARK--
message capability'
2299.736610000:2b73e241aa90: Requested to load module 'immark'
2299.736618000:2b73e241aa90: loading module '/usr/lib/rsyslog/immark.so'
2299.736662000:2b73e241aa90: module of type 0 being loaded.
2299.736673000:2b73e241aa90: cfline: '$ModLoad imuxsock # provides support for
local system logging (e.g. via logger command)'
2299.736680000:2b73e241aa90: Requested to load module 'imuxsock'
2299.736687000:2b73e241aa90: loading module '/usr/lib/rsyslog/imuxsock.so'
2299.736734000:2b73e241aa90: imuxsock version 4.6.6 initializing
2299.736752000:2b73e241aa90: module of type 0 being loaded.
2299.736761000:2b73e241aa90: cfline: '$ModLoad imklog # kernel logging
(formerly provided by rklogd)'
2299.736768000:2b73e241aa90: Requested to load module 'imklog'
2299.736775000:2b73e241aa90: loading module '/usr/lib/rsyslog/imklog.so'
2299.736857000:2b73e241aa90: module of type 0 being loaded.
2299.736868000:2b73e241aa90: cfline: '$ModLoad ommysql'
2299.736876000:2b73e241aa90: Requested to load module 'ommysql'
2299.736882000:2b73e241aa90: loading module '/usr/lib/rsyslog/ommysql.so'
2299.739351000:2b73e241aa90: module of type 1 being loaded.
2299.739364000:2b73e241aa90: entry point 'doHUP' not present in module
2299.739373000:2b73e241aa90: cfline: '$MainMsgQueueSize 5'
2299.739382000:2b73e241aa90: cfline: '$WorkDirectory /var/log/rsyslogq #
default location for work (spool) files'
2299.739390000:2b73e241aa90: cfline: '$ActionQueueType LinkedList # use
asynchronous processing'
2299.739398000:2b73e241aa90: action queue type set to LINKEDLIST
2299.739405000:2b73e241aa90: cfline: '$ActionQueueFileName dbq # set file
name, also enables disk mode'
2299.739413000:2b73e241aa90: cfline: '$ActionResumeRetryCount -1 # infinite
retries on insert failure'
2299.739422000:2b73e241aa90: cfline: 'if $syslogseverity-text == 'info' and
$syslogtag contains 'snmpd' then ~'
2299.739429000:2b73e241aa90: - general expression-based filter
2299.739437000:2b73e241aa90: skipped whitespace, stream now
'$syslogseverity-text == 'info' and $syslogtag contains 'snmpd' then ~'
2299.739447000:2b73e241aa90: ctok_token 0x1e57b020: token: 13
2299.739456000:2b73e241aa90: expr 0x1e572ad0: MSGVAR
2299.739473000:2b73e241aa90: skipped whitespace, stream now '== 'info' and
$syslogtag contains 'snmpd' then ~'
2299.739480000:2b73e241aa90: ctok_token 0x1e57b020: token: 100
2299.739488000:2b73e241aa90: expr 0x1e572ad0: cmp
2299.739495000:2b73e241aa90: skipped whitespace, stream now ''info' and
$syslogtag contains 'snmpd' then ~'
2299.739578000:2b73e241aa90: ctok_token 0x1e57b1a0: token: 14
2299.739586000:2b73e241aa90: expr 0x1e572ad0: simpstr
2299.739594000:2b73e241aa90: skipped whitespace, stream now 'and $syslogtag
contains 'snmpd' then ~'
2299.739601000:2b73e241aa90: skipped whitespace, stream now 'and $syslogtag
contains 'snmpd' then ~'
2299.739607000:2b73e241aa90: ctok_token 0x1e57b1a0: token: 2
2299.739617000:2b73e241aa90: expr 0x1e572ad0: and
2299.739626000:2b73e241aa90: skipped whitespace, stream now '$syslogtag
contains 'snmpd' then ~'
2299.739633000:2b73e241aa90: ctok_token 0x1e57b020: token: 13
2299.739641000:2b73e241aa90: expr 0x1e572ad0: MSGVAR
2299.739649000:2b73e241aa90: skipped whitespace, stream now 'contains 'snmpd'
then ~'
2299.739655000:2b73e241aa90: skipped whitespace, stream now 'contains 'snmpd'
then ~'
2299.739662000:2b73e241aa90: ctok_token 0x1e57b020: token: 105
2299.739670000:2b73e241aa90: expr 0x1e572ad0: cmp
2299.739678000:2b73e241aa90: skipped whitespace, stream now ''snmpd' then ~'
2299.739684000:2b73e241aa90: ctok_token 0x1e57b4c0: token: 14
2299.739692000:2b73e241aa90: expr 0x1e572ad0: simpstr
2299.739700000:2b73e241aa90: skipped whitespace, stream now 'then ~'
2299.739706000:2b73e241aa90: skipped whitespace, stream now 'then ~'
2299.739713000:2b73e241aa90: ctok_token 0x1e57b4c0: token: 18
2299.739721000:2b73e241aa90: expr 0x1e572ad0: successfully parsed/created
expression
2299.739730000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.739737000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.739743000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.739750000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.739756000:2b73e241aa90: discard
2299.739762000:2b73e241aa90: tried selector action for builtin-discard: 0
2299.739770000:2b73e241aa90: Module builtin-discard processed this config line.
2299.739778000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.739788000:2b73e241aa90: action 1 queue: save on shutdown 1, max disk space
allowed 0
2299.739798000:2b73e241aa90: action 1 queue: is disk-assisted, disk will be
used on demand
2299.739807000:2b73e241aa90: action 1 queue: type 1, enq-only 0, disk assisted
1, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.739816000:2b73e241aa90: action 1 queue:Reg: finalizing construction of
worker thread pool
2299.739824000:2b73e241aa90: action 1 queue:Reg/w0: finalizing construction of
worker instance data
2299.739834000:2b73e241aa90: action 1 queue: no .qi file found
2299.739842000:2b73e241aa90: action 1 queue: error -2040 trying to access
on-disk queue files, starting without them. Some data may be lost
2299.739849000:2b73e241aa90: action 1 queue: queue starts up without (loading)
any DA disk state (this is normal for the DA queue itself!)
2299.739857000:2b73e241aa90: action 1 queue:Reg: high activity - starting 1
additional worker thread(s).
2299.739864000:2b73e241aa90: action 1 queue:Reg/w0: receiving command 2
2299.739888000:2b73e241aa90: action 1 queue:Reg: started with state 0, num
workers now 1
2299.739896000:2b73e241aa90: Action 0x1e57b6b0: queue 0x1e57b790 created
2299.739903000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.739912000:2b73e241aa90: cfline: '$template vtfw,"insert into vtfw
(Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt,
InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%',
%syslogpriority%, '%timereported:::date-mysql%',
'%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL'
2299.739932000:2b73e241aa90: cfline: 'if ($fromhost-ip contains '10.128.255')
then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.739939000:2b73e241aa90: selector line successfully processed
2299.739951000:2b73e241aa90: - general expression-based filter
2299.739959000:2b73e241aa90: skipped whitespace, stream now '($fromhost-ip
contains '10.128.255') then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.739966000:2b73e241aa90: ctok_token 0x1e57cc50: token: 10
2299.739974000:2b73e241aa90: expr 0x1e57af30: expr
2299.739982000:2b73e241aa90: skipped whitespace, stream now '$fromhost-ip
contains '10.128.255') then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.739989000:2b73e241aa90: ctok_token 0x1e57cc50: token: 13
2299.739997000:2b73e241aa90: expr 0x1e57af30: MSGVAR
2299.740005000:2b73e241aa90: skipped whitespace, stream now 'contains
'10.128.255') then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.740012000:2b73e241aa90: skipped whitespace, stream now 'contains
'10.128.255') then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.740018000:2b73e241aa90: ctok_token 0x1e57cc50: token: 105
2299.740026000:2b73e241aa90: expr 0x1e57af30: cmp
2299.740034000:2b73e241aa90: skipped whitespace, stream now ''10.128.255') then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.740041000:2b73e241aa90: ctok_token 0x1e57ce30: token: 14
2299.740048000:2b73e241aa90: expr 0x1e57af30: simpstr
2299.740057000:2b73e241aa90: skipped whitespace, stream now ') then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.740063000:2b73e241aa90: ctok_token 0x1e57ce30: token: 9
2299.740074000:2b73e241aa90: skipped whitespace, stream now 'then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.740080000:2b73e241aa90: skipped whitespace, stream now 'then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vtfw'
2299.740087000:2b73e241aa90: ctok_token 0x1e57ce30: token: 18
2299.740095000:2b73e241aa90: expr 0x1e57af30: successfully parsed/created
expression
2299.740104000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.740111000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.740117000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.740124000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.740131000:2b73e241aa90: tried selector action for builtin-discard: -2001
2299.740137000:2b73e241aa90: tried selector action for builtin-usrmsg: -2001
2299.740146000:2b73e241aa90: tried selector action for ommysql: 0
2299.740152000:2b73e241aa90: Module ommysql processed this config line.
2299.740160000:2b73e241aa90: template: 'vtfw' assigned
2299.740168000:2b73e241aa90: action 2 queue: save on shutdown 1, max disk space
allowed 0
2299.740177000:2b73e241aa90: action 2 queue: type 3, enq-only 0, disk assisted
0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.740185000:2b73e241aa90: Action 0x1e57d2b0: queue 0x1e57d3f0 created
2299.740193000:2b73e241aa90: cfline: '& ~'
2299.740199000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.740205000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.740212000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.740218000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.740224000:2b73e241aa90: discard
2299.740230000:2b73e241aa90: tried selector action for builtin-discard: 0
2299.740237000:2b73e241aa90: Module builtin-discard processed this config line.
2299.740243000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.740251000:2b73e241aa90: action 3 queue: save on shutdown 1, max disk space
allowed 0
2299.740260000:2b73e241aa90: action 3 queue: type 3, enq-only 0, disk assisted
0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.740268000:2b73e241aa90: Action 0x1e57d670: queue 0x1e57d750 created
2299.740274000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.740282000:2b73e241aa90: cfline: '$template vt1hs1_switches,"insert into
vt1hs1_switches (Message, Facility, FromHost, Priority, DeviceReportedTime,
ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%,
'%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%',
'%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL'
2299.740306000:2b73e241aa90: cfline: 'if $fromhost-ip contains '10.128.0' or
$hostname contains_i 'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740313000:2b73e241aa90: selector line successfully processed
2299.740320000:2b73e241aa90: - general expression-based filter
2299.740327000:2b73e241aa90: skipped whitespace, stream now '$fromhost-ip
contains '10.128.0' or $hostname contains_i 'core01' or $hostname contains_i
'core02' then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740335000:2b73e241aa90: ctok_token 0x1e57eb10: token: 13
2299.740343000:2b73e241aa90: expr 0x1e57cfd0: MSGVAR
2299.740351000:2b73e241aa90: skipped whitespace, stream now 'contains
'10.128.0' or $hostname contains_i 'core01' or $hostname contains_i 'core02'
then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740358000:2b73e241aa90: skipped whitespace, stream now 'contains
'10.128.0' or $hostname contains_i 'core01' or $hostname contains_i 'core02'
then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740364000:2b73e241aa90: ctok_token 0x1e57eb10: token: 105
2299.740372000:2b73e241aa90: expr 0x1e57cfd0: cmp
2299.740381000:2b73e241aa90: skipped whitespace, stream now ''10.128.0' or
$hostname contains_i 'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740387000:2b73e241aa90: ctok_token 0x1e57ecb0: token: 14
2299.740395000:2b73e241aa90: expr 0x1e57cfd0: simpstr
2299.740403000:2b73e241aa90: skipped whitespace, stream now 'or $hostname
contains_i 'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740409000:2b73e241aa90: skipped whitespace, stream now 'or $hostname
contains_i 'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740416000:2b73e241aa90: ctok_token 0x1e57ecb0: token: 1
2299.740424000:2b73e241aa90: expr 0x1e57cfd0: found OR
2299.740432000:2b73e241aa90: skipped whitespace, stream now '$hostname
contains_i 'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740439000:2b73e241aa90: ctok_token 0x1e57eb10: token: 13
2299.740446000:2b73e241aa90: expr 0x1e57cfd0: MSGVAR
2299.740455000:2b73e241aa90: skipped whitespace, stream now 'contains_i
'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740461000:2b73e241aa90: skipped whitespace, stream now 'contains_i
'core01' or $hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740468000:2b73e241aa90: ctok_token 0x1e57eb10: token: 107
2299.740475000:2b73e241aa90: expr 0x1e57cfd0: cmp
2299.740485000:2b73e241aa90: skipped whitespace, stream now ''core01' or
$hostname contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740492000:2b73e241aa90: ctok_token 0x1e57efd0: token: 14
2299.740572000:2b73e241aa90: expr 0x1e57cfd0: simpstr
2299.740581000:2b73e241aa90: skipped whitespace, stream now 'or $hostname
contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740588000:2b73e241aa90: skipped whitespace, stream now 'or $hostname
contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740594000:2b73e241aa90: ctok_token 0x1e57efd0: token: 1
2299.740603000:2b73e241aa90: expr 0x1e57cfd0: found OR
2299.740613000:2b73e241aa90: skipped whitespace, stream now '$hostname
contains_i 'core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740620000:2b73e241aa90: ctok_token 0x1e57ecb0: token: 13
2299.740629000:2b73e241aa90: expr 0x1e57cfd0: MSGVAR
2299.740637000:2b73e241aa90: skipped whitespace, stream now 'contains_i
'core02' then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740643000:2b73e241aa90: skipped whitespace, stream now 'contains_i
'core02' then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740656000:2b73e241aa90: ctok_token 0x1e57ecb0: token: 107
2299.740666000:2b73e241aa90: expr 0x1e57cfd0: cmp
2299.740675000:2b73e241aa90: skipped whitespace, stream now ''core02' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740683000:2b73e241aa90: ctok_token 0x1e57f2b0: token: 14
2299.740692000:2b73e241aa90: expr 0x1e57cfd0: simpstr
2299.740701000:2b73e241aa90: skipped whitespace, stream now 'then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740708000:2b73e241aa90: skipped whitespace, stream now 'then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_switches'
2299.740716000:2b73e241aa90: ctok_token 0x1e57f2b0: token: 18
2299.740726000:2b73e241aa90: expr 0x1e57cfd0: successfully parsed/created
expression
2299.740736000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.740743000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.740751000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.740759000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.740767000:2b73e241aa90: tried selector action for builtin-discard: -2001
2299.740775000:2b73e241aa90: tried selector action for builtin-usrmsg: -2001
2299.740785000:41110940: action 1 queue:Reg/w0: receiving command 4
2299.740808000:41110940: action 1 queue:Reg/w0: worker IDLE, waiting for work.
2299.740832000:2b73e241aa90: tried selector action for ommysql: 0
2299.740846000:2b73e241aa90: Module ommysql processed this config line.
2299.740857000:2b73e241aa90: template: 'vt1hs1_switches' assigned
2299.740869000:2b73e241aa90: action 4 queue: save on shutdown 1, max disk space
allowed 0
2299.740882000:2b73e241aa90: action 4 queue: type 3, enq-only 0, disk assisted
0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.740890000:2b73e241aa90: Action 0x1e57f6f0: queue 0x1e57f830 created
2299.740898000:2b73e241aa90: cfline: '& ~'
2299.740905000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.740912000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.740918000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.740925000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.740931000:2b73e241aa90: discard
2299.740937000:2b73e241aa90: tried selector action for builtin-discard: 0
2299.740943000:2b73e241aa90: Module builtin-discard processed this config line.
2299.740950000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.740958000:2b73e241aa90: action 5 queue: save on shutdown 1, max disk space
allowed 0
2299.740967000:2b73e241aa90: action 5 queue: type 3, enq-only 0, disk assisted
0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.740975000:2b73e241aa90: Action 0x1e57fab0: queue 0x1e57fb90 created
2299.740981000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.740990000:2b73e241aa90: cfline: '$template vt1hs1_wifi,"insert into
vt1hs1_wifi (Message, Facility, FromHost, Priority, DeviceReportedTime,
ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%,
'%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%',
'%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL'
2299.741010000:2b73e241aa90: cfline: 'if $fromhost-ip contains '10.128.244'
then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741018000:2b73e241aa90: selector line successfully processed
2299.741024000:2b73e241aa90: - general expression-based filter
2299.741032000:2b73e241aa90: skipped whitespace, stream now '$fromhost-ip
contains '10.128.244' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741039000:2b73e241aa90: ctok_token 0x1e57fed0: token: 13
2299.741048000:2b73e241aa90: expr 0x1e57f430: MSGVAR
2299.741058000:2b73e241aa90: skipped whitespace, stream now 'contains
'10.128.244' then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741065000:2b73e241aa90: skipped whitespace, stream now 'contains
'10.128.244' then :ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741079000:2b73e241aa90: ctok_token 0x1e57fed0: token: 105
2299.741088000:2b73e241aa90: expr 0x1e57f430: cmp
2299.741096000:2b73e241aa90: skipped whitespace, stream now ''10.128.244' then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741102000:2b73e241aa90: ctok_token 0x1e581060: token: 14
2299.741110000:2b73e241aa90: expr 0x1e57f430: simpstr
2299.741118000:2b73e241aa90: skipped whitespace, stream now 'then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741125000:2b73e241aa90: skipped whitespace, stream now 'then
:ommysql:localhost,Syslog,idontthinkso,XXXXXXXXX;vt1hs1_wifi'
2299.741131000:2b73e241aa90: ctok_token 0x1e581060: token: 18
2299.741139000:2b73e241aa90: expr 0x1e57f430: successfully parsed/created
expression
2299.741148000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.741154000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.741161000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.741167000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.741173000:2b73e241aa90: tried selector action for builtin-discard: -2001
2299.741180000:2b73e241aa90: tried selector action for builtin-usrmsg: -2001
2299.741188000:2b73e241aa90: tried selector action for ommysql: 0
2299.741194000:2b73e241aa90: Module ommysql processed this config line.
2299.741201000:2b73e241aa90: template: 'vt1hs1_wifi' assigned
2299.741209000:2b73e241aa90: action 6 queue: save on shutdown 1, max disk space
allowed 0
2299.741218000:2b73e241aa90: action 6 queue: type 3, enq-only 0, disk assisted
0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.741226000:2b73e241aa90: Action 0x1e5814e0: queue 0x1e581620 created
2299.741233000:2b73e241aa90: cfline: '& ~'
2299.741240000:2b73e241aa90: tried selector action for builtin-file: -2001
2299.741246000:2b73e241aa90: tried selector action for builtin-pipe: -2001
2299.741252000:2b73e241aa90: tried selector action for builtin-fwd: -2001
2299.741258000:2b73e241aa90: tried selector action for builtin-shell: -2001
2299.741265000:2b73e241aa90: discard
2299.741271000:2b73e241aa90: tried selector action for builtin-discard: 0
2299.741277000:2b73e241aa90: Module builtin-discard processed this config line.
2299.741283000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
2299.741290000:2b73e241aa90: action 7 queue: save on shutdown 1, max disk space
allowed 0
2299.741299000:2b73e241aa90: action 7 queue: type 3, enq-only 0, disk assisted
0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light delay 700 starting
2299.741307000:2b73e241aa90: Action 0x1e5818a0: queue 0x1e581980 created
2299.741313000:2b73e241aa90: module is incompatible with RepeatedMsgReduction -
turned off
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
