1) Changed the conf and put the "ruleset" param in the input statement:
module(load="imrelp") input(type="imrelp" port="518" ruleset="netlogs") # rsyslogd -f /etc/rsyslog.conf -N1 -n rsyslogd: version 7.4.1, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or before line 75: parameter 'ruleset' not known -- typo in config file? [try http://www.rsyslog.com/e/2207 ] 2) Documentation on the rsyslog site says for RELP, the "ruleset" param goes in the module statement: http://www.rsyslog.com/doc/imrelp.html<http://www.rsyslog.com/tls-secured-syslog-via-relp/> *Module Parameters*: - *Ruleset* <name> Binds the specified ruleset to *all* RELP listeners On Thu, Aug 15, 2013 at 12:52 PM, David Lang <[email protected]> wrote: > I believe that you would tie a ruleset to an input, not to a module. Try > moving the ruleset line from the module to the input. > > David Lang > > > On Thu, 15 Aug 2013, Xuri Nagarin wrote: > > I see the same errors with 7.4.3 too. >> >> >> >> >> On Thu, Aug 15, 2013 at 11:31 AM, Xuri Nagarin <[email protected]> wrote: >> >> I keep running into this error even without tls for RELP: >>> >>> rsyslogd -f /etc/rsyslog.conf -N1 -n >>> rsyslogd: version 7.4.1, config validation run (level 1), master config >>> /etc/rsyslog.conf >>> rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or before >>> line 74: parameter 'ruleset' not known -- typo in config file? [try >>> http://www.rsyslog.com/e/2207 ] >>> rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or before >>> line 75: parameter 'tls' not known -- typo in config file? [try >>> http://www.rsyslog.com/e/2207 ] >>> rsyslogd: End of config validation run. Bye. >>> >>> Config in /etc/rsyslog.d/ext.conf says: >>> >>> module(load="imrelp" ruleset="netlogs") <<--------- Line 74 >>> input(type="imrelp" port="516" tls="off") >>> >>> >>> >>> >>> >>> >>> >>> >>> On Wed, Aug 14, 2013 at 7:02 AM, Rainer Gerhards < >>> [email protected] >>> >>>> wrote: >>>> >>> >>> Run imptcp for plain tcp. Relp tls requires devel. >>>> >>>> Sent from phone, thus brief. >>>> Am 14.08.2013 09:56 schrieb "Radu Gheorghe" <[email protected]>: >>>> >>>> Hello, >>>>> >>>>> If no-one else comes with a better idea, you can use two rsyslog >>>>> >>>> processes: >>>> >>>>> one to listen for plain TCP, and the other for TLS-enabled TCP. >>>>> On Aug 13, 2013 11:51 PM, "Xuri Nagarin" <[email protected]> wrote: >>>>> >>>>> Hi, >>>>>> >>>>>> I am running 7.4.1 (installed from RPMs off the rsyslog site) on RHEL >>>>>> >>>>> 6.2 >>>> >>>>> >>>>>> On the server side, I need to receive messages from other Syslog (mix >>>>>> >>>>> of >>>> >>>>> rsyslog/syslog-ng) servers in both - TLS and plain TCP. >>>>>> >>>>>> That seems to rule out using the imtcp module with TLS since >>>>>> >>>>> streamdriver >>>> >>>>> parameters seem to be module wide so I cannot have one TCP port >>>>>> >>>>> listening >>>> >>>>> for plain text and another with TLS. Right? >>>>>> >>>>>> If I try using RELP+TLS (for rsyslog clients), this document requires >>>>>> minimum of 7.5.1 that is a Dev branch so I cannot deploy it: >>>>>> http://www.rsyslog.com/using-**tls-with-relp/<http://www.rsyslog.com/using-tls-with-relp/> >>>>>> >>>>>> This other document on RELP+TLS should work but it does not tell me >>>>>> >>>>> where >>>> >>>>> to configure key and cert locations: >>>>>> http://www.rsyslog.com/tls-**secured-syslog-via-relp/<http://www.rsyslog.com/tls-secured-syslog-via-relp/> >>>>>> >>>>>> Also, rsyslog throws an error - "error during parsing file >>>>>> /etc/rsyslog.d/extend.conf, on or before line 73: parameter 'ruleset' >>>>>> >>>>> not >>>> >>>>> known -- typo in config file? [try http://www.rsyslog.com/e/2207 ]" >>>>>> >>>>>> if I try to configure a imrelp module like this: >>>>>> module(load="imrelp" ruleset="myrule") >>>>>> >>>>>> If I remove the /ruleset/ parameter, rsyslog loads up fine. >>>>>> >>>>>> Does anyone have a similar config that I can use as reference? >>>>>> >>>>>> TIA, >>>>>> >>>>>> Xuri >>>>>> ______________________________**_________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>> >>>>> myriad >>>> >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>>> DON'T LIKE THAT. >>>>>> >>>>>> ______________________________**_________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>> myriad >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>> DON'T LIKE THAT. >>>>> >>>>> ______________________________**_________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>>> >>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
