The files are read in inode order. At the last place I worked we instituted a policy that all rsyslog conf files in the .d directory needed to be completely self contained and not rely on any other part of the conf because of this. It'll save you some headaches.
Brian On Fri, Apr 27, 2012 at 12:17 PM, <[email protected]> wrote: > On Fri, 27 Apr 2012, Steven Willis wrote: > > Ah, I think I figured it out. I put the directive to load omrelp and the >> filter that used it into different files under /etc/rsyslog.d/. The file >> containing the load statement was being processes after the file containing >> the filter so omrelp wasn't yet available. I still don't know why the exact >> same setup worked on my other boxes. Are filters lazily evaluated in later >> versions of rsyslog? >> > > I don't believe that there is any lazy evaluation in the config files. I > believe that the files will get read in alpha order, but it's possible that > they could be read in inode order. In any case, I would not have > dependancies between different files in /etc/rsyslog.d, the odds of it > causing grief later are just too high. > > David Lang > > > -Steven Willis >> ______________________________**__________ >> From: [email protected].**com<[email protected]>[ >> rsyslog-bounces@lists.**adiscon.com <[email protected]>] >> On Behalf Of [email protected] [[email protected]] >> Sent: Thursday, April 26, 2012 7:39 PM >> To: rsyslog-users >> Subject: Re: [rsyslog] error on app-name contains >> >> As I read this, it's failing in trying to figure out the action. Please >> try the same condition, but just writing to a file instead of to relp. >> that will tell us if it's the condition that's the problem or the >> destination. >> >> It's looking like relp may not be enabled on your build. >> >> David Lang >> >> On Thu, 26 Apr 2012, Steven Willis wrote: >> >> Here's the same run with -d >>> >>> 7309.623707350:7ff800f7c700: requested to include config file >>> '/etc/rsyslog-test/rsyslog.d/**10-datanode.conf' >>> 7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"**DataNode" >>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat' >>> 7309.623786771:7ff800f7c700: - property-based filter >>> 7309.623813276:7ff800f7c700: tried selector action for builtin-file: >>> -2001 >>> 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe: >>> -2001 >>> 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001 >>> 7309.623865515:7ff800f7c700: tried selector action for builtin-shell: >>> -2001 >>> 7309.623882173:7ff800f7c700: tried selector action for builtin-discard: >>> -2001 >>> 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg: >>> -2001 >>> 7309.623914751:7ff800f7c700: config line NOT successfully processed >>> 7309.623934707:7ff800f7c700: Called LogError, msg: the last error >>> occured in /etc/rsyslog-test/rsyslog.d/**10-datanode.conf, line >>> 1:":programname,isequal,"**DataNode" :omrelp:opbhdname001:20514;** >>> RSYSLOG_ForwardFormat" >>> rsyslogd: the last error occured in >>> /etc/rsyslog-test/rsyslog.d/**10-datanode.conf, >>> line 1:":programname,isequal,"**DataNode" >>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat" >>> >>> -----Original Message----- >>>> From: >>>> [email protected].**com<[email protected]>[mailto: >>>> rsyslog- >>>> [email protected]] On Behalf Of Steven Willis >>>> Sent: Thursday, April 26, 2012 12:39 PM >>>> To: rsyslog-users >>>> Subject: Re: [rsyslog] error on app-name contains >>>> >>>> There was no particular reason to use app-name rather than programname, >>>> but I still get the error when using programname: >>>> >>>> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in >>>> /etc/rsyslog.d/10-datanode.**conf, line >>>> 1:":programname,isequal,"**DataNode" >>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat" >>>> >>>> -Steven Willis >>>> ______________________________**__________ >>>> From: >>>> [email protected].**com<[email protected]>[rsyslog- >>>> [email protected]] On Behalf Of [email protected] [[email protected]] >>>> Sent: Thursday, April 26, 2012 12:09 PM >>>> To: rsyslog-users >>>> Subject: Re: [rsyslog] error on app-name contains >>>> >>>> The other thing is that it may be that app-name doesn't exist in such >>>> an old version. >>>> >>>> Why are you using app-name instead of programname? >>>> >>>> David Lang >>>> >>>> On Thu, 26 Apr 2012, Steven Willis wrote: >>>> >>>> Date: Thu, 26 Apr 2012 10:43:23 -0400 >>>>> From: Steven Willis <[email protected]> >>>>> Reply-To: rsyslog-users <[email protected]> >>>>> To: rsyslog-users <[email protected]> >>>>> Subject: Re: [rsyslog] error on app-name contains >>>>> >>>>> Well, I tried changing it to single quotes and that completely broke >>>>> >>>> rsyslog. It would crash on startup, no error messages or anything. I >>>> also tried no quotes, but that failed just like single quotes. I also >>>> tried adding spaces after the commas, but that made no difference. I >>>> noticed that in the default redhat config all the modules had .so after >>>> them, whereas my ubuntu config didn't. It seemed like I could do it >>>> either way on the $ModLoad line, but perhaps I need to do :omrelp.so: >>>> when using it? >>>> >>>>> >>>>> -Steve >>>>> ______________________________**__________ >>>>> From: >>>>> [email protected].**com<[email protected]> >>>>> [rsyslog-bounces@lists.**adiscon.com<[email protected]>] >>>>> On Behalf Of [email protected] >>>>> [[email protected]] >>>>> Sent: Wednesday, April 25, 2012 8:29 PM >>>>> To: rsyslog-users >>>>> Subject: Re: [rsyslog] error on app-name contains >>>>> >>>>> the first thing that I always look at is should you use " or ' >>>>> >>>> rsyslog >>>> >>>>> 4.x only accepts one, and I _think_ I remember it's ' >>>>> >>>>> David Lang >>>>> >>>>> On Wed, 25 Apr 2012, Steven Willis wrote: >>>>> >>>>> Hi, >>>>>> >>>>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line: >>>>>> >>>>>> :app-name,contains,"DataNode" >>>>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat >>>>>> >>>>>> The error line in /var/log/messages is: >>>>>> >>>>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in >>>>>> >>>>> /etc/rsyslog.d/10-datanode.**conf, line 1:":app-name,contains,"** >>>> DataNode" >>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat" >>>> >>>>> >>>>>> I don't get that error with 5.8.1 on ubuntu. I looked through the >>>>>> >>>>> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm >>>> doing it right, can you help me out? >>>> >>>>> >>>>>> -Steven Willis >>>>>> ______________________________**_________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>> >>>>>> ______________________________**_________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> ______________________________**_________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> >>>>> ______________________________**_________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> ______________________________**_________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> >>> ______________________________**_________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
