That was a wrong tip. Not sure, however, if I manage to load your conf this evening. Note that tomorrow is a holiday over here (yay, once again ;)) and I will probably not be at my machine.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Wednesday, June 06, 2012 4:02 PM > To: rsyslog-users > Subject: Re: [rsyslog] Error message with no error ?? Or I'm > misinterpretingit? > > Just quickly, should have noticed earlier: are you sure double quotes (") are > OK? I > am not sure I already support them. If in question, use single quotes ('). > Will > elaborate later. > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Jason Marshall > > Sent: Wednesday, June 06, 2012 4:00 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] Error message with no error ?? Or I'm > > misinterpretingit? > > > > Thanks Rainer! Here is my config -- it's pretty hacked up right now, > > but > > I have most of the good bits commented out trying to isolate the > > problem: > > > > # Use traditional timestamp format > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > > > > $ModLoad immark # provides --MARK-- message capability > > $ModLoad imudp # provides UDP syslog reception > > $UDPServerAddress 172.23.62.1 # this MUST be before the $UDPServerRun > > directive! > > $UDPServerRun 514 > > $ModLoad imtcp # provides TCP syslog reception and GSS-API (if compiled > > to support it) > > # Provides kernel logging support (previously done by rklogd) > > $ModLoad imklog > > # Provides support for local system logging (e.g. via logger command) > > $ModLoad imuxsock > > $ModLoad ommysql > > > > $WorkDirectory /nospace/rsyslog-queue > > $ActionQueueType LinkedList # async processing > > $ActionQueueFileName rsyslog-buffer # or whatever > > $ActionResumeRetryCount -1 # infinite retries > > $ActionQueueSaveOnShutdown on # save in-memory data on shutdown. > > > > if $hostname == "172.23.48.14" then > > :ommysql:localhost,Syslog,syslog,xxxxxxxx > > > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") and > > $syslogfacility-text == "authpriv" then /var/log/secure > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") and > > $syslogfacility-text == "authpriv" then ~ > > > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") and > > $syslogfacility-text == "mail" then -/var/log/maillog > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") and > > $syslogfacility-text == "mail" then ~ > > > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") and > > $syslogfacility-text == "cron" then /var/log/cron > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") and > > $syslogfacility-text == "cron" then ~ > > > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") then > > /var/log/messages > > #if ($hostname != "172.23.48.13" and $hostname != "172.23.48.14") then > > ~ > > > > #if ($hostname == "172.23.48.13" or $hostname == "172.23.48.14") then > > @209.136.154.71 > > #if ($hostname == "172.23.48.13" or $hostname == "172.23.48.14") and > > not ($msg contains "RT_FLOW_SESSION_") then @209.136.154.71 > > > > *.emerg * > > > > > > > > > Looks like in some remote spot the actual message is not emitted. > > Please post your complete config file, so that I can run it and see the > > same problem. > > > > > > Thanks, > > > Rainer > > > > > >> -----Original Message----- > > >> From: [email protected] [mailto:rsyslog- > > >> [email protected]] On Behalf Of Jason Marshall > > >> Sent: Wednesday, June 06, 2012 5:36 AM > > >> To: [email protected] > > >> Subject: [rsyslog] Error message with no error ?? Or I'm > > misinterpreting it? > > >> > > >> I tried looking through the archives, but didn't find what I was > > looking > > >> for. I'm having issues with my rsyslog.conf file, and when I run > > rsyslogd > > >> -N 1 (or any other number) I get the nebulous message "rsyslogd: the > > last > > >> error occured in /etc/rsyslog.conf, line 29:...............". BUT, > > there > > >> is no "last message": > > >> > > >> -bash-3.2# rsyslogd -f /etc/rsyslog.conf -N 9 -c5 > > >> rsyslogd: version 6.2.1, config validation run (level 9), master > > config > > >> /etc/rsyslog.conf > > >> rsyslogd: the last error occured in /etc/rsyslog.conf, line 29:"if > > $hostname == > > >> "172.23.48.14" then > > >> :ommysql:localhost,Syslog,syslog,xxxxxxxx" > > >> rsyslogd: warning: selector line without actions will be discarded > > >> > > >> I compiled rsyslogd-6.2.1 from source, and don't believe I got any > > >> warnings during the process... Kind of scratching my head here > > because my > > >> syntax appears to match that of the examples I've found online... > > Any > > >> ideas? Thanks in advance!! > > >> > > >> --- > > >> Jason Marshall > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com/professional-services/ > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > > > > > > > --- > > Jason Marshall > > IT Manager > > Kelman Data Management > > 403.294.7557 > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
