Debug doesn't show anything very interesting either: 1967.352896200:7f46c50be740: cnf:global:obj: obj: 'module' 1967.352899799:7f46c50be740: nvlst 0x7f46c62a87b0: 1967.352901843:7f46c50be740: name: 'ruleset', value 'netlogs' 1967.352909123:7f46c50be740: name: 'load', value 'imrelp' 1967.352911526:7f46c50be740: nvlstGetParam: name 'load', type 13, valnode->bUsed 0 1967.352913762:7f46c50be740: modulesProcessCnf params: 1967.352915724:7f46c50be740: load: 'imrelp' 1967.352920981:7f46c50be740: Requested to load module 'imrelp' 1967.352923649:7f46c50be740: loading module '/lib64/rsyslog/imrelp.so' 1967.353043026:7f46c50be740: source file imrelp.c requested reference for module 'lmnet', reference count now 4 1967.353055069:7f46c50be740: module imrelp of type 0 being loaded (keepType=0). 1967.353059450:7f46c50be740: entry point 'setModCnf' not present in module 1967.353061970:7f46c50be740: module config name is 'imrelp' 1967.353064213:7f46c50be740: module imrelp supports rsyslog v6 config interface 1967.353070580:7f46c50be740: Called LogError, msg: error during parsing file /etc/rsyslog.d/ext.conf, on or before line 74: parameter 'ruleset' not known -- typo in config file? rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or before line 74: parameter 'ruleset' not known -- typo in config file? [try http://www.rsyslog.com/e/2207 ] -> $$ = nterm conf ()
On Thu, Aug 15, 2013 at 5:07 PM, Xuri Nagarin <[email protected]> wrote: > 1) Changed the conf and put the "ruleset" param in the input statement: > > module(load="imrelp") > input(type="imrelp" port="518" ruleset="netlogs") > > # rsyslogd -f /etc/rsyslog.conf -N1 -n > > rsyslogd: version 7.4.1, config validation run (level 1), master config > /etc/rsyslog.conf > rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or before > line 75: parameter 'ruleset' not known -- typo in config file? [try > http://www.rsyslog.com/e/2207 ] > > 2) Documentation on the rsyslog site says for RELP, the "ruleset" param > goes in the module statement: > http://www.rsyslog.com/doc/imrelp.html<http://www.rsyslog.com/tls-secured-syslog-via-relp/> > > *Module Parameters*: > > - *Ruleset* <name> > Binds the specified ruleset to *all* RELP listeners > > > > > > > > On Thu, Aug 15, 2013 at 12:52 PM, David Lang <[email protected]> wrote: > >> I believe that you would tie a ruleset to an input, not to a module. Try >> moving the ruleset line from the module to the input. >> >> David Lang >> >> >> On Thu, 15 Aug 2013, Xuri Nagarin wrote: >> >> I see the same errors with 7.4.3 too. >>> >>> >>> >>> >>> On Thu, Aug 15, 2013 at 11:31 AM, Xuri Nagarin <[email protected]> >>> wrote: >>> >>> I keep running into this error even without tls for RELP: >>>> >>>> rsyslogd -f /etc/rsyslog.conf -N1 -n >>>> rsyslogd: version 7.4.1, config validation run (level 1), master config >>>> /etc/rsyslog.conf >>>> rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or >>>> before >>>> line 74: parameter 'ruleset' not known -- typo in config file? [try >>>> http://www.rsyslog.com/e/2207 ] >>>> rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or >>>> before >>>> line 75: parameter 'tls' not known -- typo in config file? [try >>>> http://www.rsyslog.com/e/2207 ] >>>> rsyslogd: End of config validation run. Bye. >>>> >>>> Config in /etc/rsyslog.d/ext.conf says: >>>> >>>> module(load="imrelp" ruleset="netlogs") <<--------- Line 74 >>>> input(type="imrelp" port="516" tls="off") >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> On Wed, Aug 14, 2013 at 7:02 AM, Rainer Gerhards < >>>> [email protected] >>>> >>>>> wrote: >>>>> >>>> >>>> Run imptcp for plain tcp. Relp tls requires devel. >>>>> >>>>> Sent from phone, thus brief. >>>>> Am 14.08.2013 09:56 schrieb "Radu Gheorghe" <[email protected]>: >>>>> >>>>> Hello, >>>>>> >>>>>> If no-one else comes with a better idea, you can use two rsyslog >>>>>> >>>>> processes: >>>>> >>>>>> one to listen for plain TCP, and the other for TLS-enabled TCP. >>>>>> On Aug 13, 2013 11:51 PM, "Xuri Nagarin" <[email protected]> wrote: >>>>>> >>>>>> Hi, >>>>>>> >>>>>>> I am running 7.4.1 (installed from RPMs off the rsyslog site) on RHEL >>>>>>> >>>>>> 6.2 >>>>> >>>>>> >>>>>>> On the server side, I need to receive messages from other Syslog (mix >>>>>>> >>>>>> of >>>>> >>>>>> rsyslog/syslog-ng) servers in both - TLS and plain TCP. >>>>>>> >>>>>>> That seems to rule out using the imtcp module with TLS since >>>>>>> >>>>>> streamdriver >>>>> >>>>>> parameters seem to be module wide so I cannot have one TCP port >>>>>>> >>>>>> listening >>>>> >>>>>> for plain text and another with TLS. Right? >>>>>>> >>>>>>> If I try using RELP+TLS (for rsyslog clients), this document requires >>>>>>> minimum of 7.5.1 that is a Dev branch so I cannot deploy it: >>>>>>> http://www.rsyslog.com/using-**tls-with-relp/<http://www.rsyslog.com/using-tls-with-relp/> >>>>>>> >>>>>>> This other document on RELP+TLS should work but it does not tell me >>>>>>> >>>>>> where >>>>> >>>>>> to configure key and cert locations: >>>>>>> http://www.rsyslog.com/tls-**secured-syslog-via-relp/<http://www.rsyslog.com/tls-secured-syslog-via-relp/> >>>>>>> >>>>>>> Also, rsyslog throws an error - "error during parsing file >>>>>>> /etc/rsyslog.d/extend.conf, on or before line 73: parameter 'ruleset' >>>>>>> >>>>>> not >>>>> >>>>>> known -- typo in config file? [try http://www.rsyslog.com/e/2207 ]" >>>>>>> >>>>>>> if I try to configure a imrelp module like this: >>>>>>> module(load="imrelp" ruleset="myrule") >>>>>>> >>>>>>> If I remove the /ruleset/ parameter, rsyslog loads up fine. >>>>>>> >>>>>>> Does anyone have a similar config that I can use as reference? >>>>>>> >>>>>>> TIA, >>>>>>> >>>>>>> Xuri >>>>>>> ______________________________**_________________ >>>>>>> rsyslog mailing list >>>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>>> >>>>>> myriad >>>>> >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>>>> DON'T LIKE THAT. >>>>>>> >>>>>>> ______________________________**_________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>> myriad >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>>> DON'T LIKE THAT. >>>>>> >>>>>> ______________________________**_________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>> myriad >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>> DON'T LIKE THAT. >>>>> >>>>> >>>> >>>> ______________________________**_________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
