Ah, I think I figured it out. I put the directive to load omrelp and the filter that used it into different files under /etc/rsyslog.d/. The file containing the load statement was being processes after the file containing the filter so omrelp wasn't yet available. I still don't know why the exact same setup worked on my other boxes. Are filters lazily evaluated in later versions of rsyslog?
-Steven Willis ________________________________________ From: [email protected] [[email protected]] On Behalf Of [email protected] [[email protected]] Sent: Thursday, April 26, 2012 7:39 PM To: rsyslog-users Subject: Re: [rsyslog] error on app-name contains As I read this, it's failing in trying to figure out the action. Please try the same condition, but just writing to a file instead of to relp. that will tell us if it's the condition that's the problem or the destination. It's looking like relp may not be enabled on your build. David Lang On Thu, 26 Apr 2012, Steven Willis wrote: > Here's the same run with -d > > 7309.623707350:7ff800f7c700: requested to include config file > '/etc/rsyslog-test/rsyslog.d/10-datanode.conf' > 7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"DataNode" > :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat' > 7309.623786771:7ff800f7c700: - property-based filter > 7309.623813276:7ff800f7c700: tried selector action for builtin-file: -2001 > 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe: -2001 > 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001 > 7309.623865515:7ff800f7c700: tried selector action for builtin-shell: -2001 > 7309.623882173:7ff800f7c700: tried selector action for builtin-discard: -2001 > 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg: -2001 > 7309.623914751:7ff800f7c700: config line NOT successfully processed > 7309.623934707:7ff800f7c700: Called LogError, msg: the last error occured in > /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line > 1:":programname,isequal,"DataNode" > :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat" > rsyslogd: the last error occured in > /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line > 1:":programname,isequal,"DataNode" > :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat" > >> -----Original Message----- >> From: [email protected] [mailto:rsyslog- >> [email protected]] On Behalf Of Steven Willis >> Sent: Thursday, April 26, 2012 12:39 PM >> To: rsyslog-users >> Subject: Re: [rsyslog] error on app-name contains >> >> There was no particular reason to use app-name rather than programname, >> but I still get the error when using programname: >> >> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in >> /etc/rsyslog.d/10-datanode.conf, line >> 1:":programname,isequal,"DataNode" >> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat" >> >> -Steven Willis >> ________________________________________ >> From: [email protected] [rsyslog- >> [email protected]] On Behalf Of [email protected] [[email protected]] >> Sent: Thursday, April 26, 2012 12:09 PM >> To: rsyslog-users >> Subject: Re: [rsyslog] error on app-name contains >> >> The other thing is that it may be that app-name doesn't exist in such >> an old version. >> >> Why are you using app-name instead of programname? >> >> David Lang >> >> On Thu, 26 Apr 2012, Steven Willis wrote: >> >>> Date: Thu, 26 Apr 2012 10:43:23 -0400 >>> From: Steven Willis <[email protected]> >>> Reply-To: rsyslog-users <[email protected]> >>> To: rsyslog-users <[email protected]> >>> Subject: Re: [rsyslog] error on app-name contains >>> >>> Well, I tried changing it to single quotes and that completely broke >> rsyslog. It would crash on startup, no error messages or anything. I >> also tried no quotes, but that failed just like single quotes. I also >> tried adding spaces after the commas, but that made no difference. I >> noticed that in the default redhat config all the modules had .so after >> them, whereas my ubuntu config didn't. It seemed like I could do it >> either way on the $ModLoad line, but perhaps I need to do :omrelp.so: >> when using it? >>> >>> -Steve >>> ________________________________________ >>> From: [email protected] >>> [[email protected]] On Behalf Of [email protected] >>> [[email protected]] >>> Sent: Wednesday, April 25, 2012 8:29 PM >>> To: rsyslog-users >>> Subject: Re: [rsyslog] error on app-name contains >>> >>> the first thing that I always look at is should you use " or ' >> rsyslog >>> 4.x only accepts one, and I _think_ I remember it's ' >>> >>> David Lang >>> >>> On Wed, 25 Apr 2012, Steven Willis wrote: >>> >>>> Hi, >>>> >>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line: >>>> >>>> :app-name,contains,"DataNode" >>>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat >>>> >>>> The error line in /var/log/messages is: >>>> >>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in >> /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode" >> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat" >>>> >>>> I don't get that error with 5.8.1 on ubuntu. I looked through the >> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm >> doing it right, can you help me out? >>>> >>>> -Steven Willis >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
