I just checked/tested to make sure. The Ruleset param in module statement is only support in v7-devel branch, as Rainer guessed.
Best regards, Andre Lorbach > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Friday, August 16, 2013 3:04 AM > To: rsyslog-users > Subject: Re: [rsyslog] TLS and Plain text - mixed mode for 7.4.1 > > The doc on the site is always for the latest (devel) version. Use the one that > comes with your version! I changed lots in regard to relp, so i guess your > version does not support these parameters. > > Rainer > > Sent from phone, thus brief. > Am 15.08.2013 20:17 schrieb "Xuri Nagarin" <[email protected]>: > > > Debug doesn't show anything very interesting either: > > > > 1967.352896200:7f46c50be740: cnf:global:obj: obj: 'module' > > 1967.352899799:7f46c50be740: nvlst 0x7f46c62a87b0: > > 1967.352901843:7f46c50be740: name: 'ruleset', value 'netlogs' > > 1967.352909123:7f46c50be740: name: 'load', value 'imrelp' > > 1967.352911526:7f46c50be740: nvlstGetParam: name 'load', type 13, > > valnode->bUsed 0 > > 1967.352913762:7f46c50be740: modulesProcessCnf params: > > 1967.352915724:7f46c50be740: load: 'imrelp' > > 1967.352920981:7f46c50be740: Requested to load module 'imrelp' > > 1967.352923649:7f46c50be740: loading module '/lib64/rsyslog/imrelp.so' > > 1967.353043026:7f46c50be740: source file imrelp.c requested reference > > for module 'lmnet', reference count now 4 > > 1967.353055069:7f46c50be740: module imrelp of type 0 being loaded > > (keepType=0). > > 1967.353059450:7f46c50be740: entry point 'setModCnf' not present in > > module > > 1967.353061970:7f46c50be740: module config name is 'imrelp' > > 1967.353064213:7f46c50be740: module imrelp supports rsyslog v6 config > > interface > > 1967.353070580:7f46c50be740: Called LogError, msg: error during > > parsing file /etc/rsyslog.d/ext.conf, on or before line 74: parameter > > 'ruleset' not known -- typo in config file? > > rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or > > before line 74: parameter 'ruleset' not known -- typo in config file? > > [try > > http://www.rsyslog.com/e/2207 ] > > -> $$ = nterm conf () > > > > > > > > > > On Thu, Aug 15, 2013 at 5:07 PM, Xuri Nagarin <[email protected]> > wrote: > > > > > 1) Changed the conf and put the "ruleset" param in the input statement: > > > > > > module(load="imrelp") > > > input(type="imrelp" port="518" ruleset="netlogs") > > > > > > # rsyslogd -f /etc/rsyslog.conf -N1 -n > > > > > > rsyslogd: version 7.4.1, config validation run (level 1), master > > > config /etc/rsyslog.conf > > > rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on or > > > before line 75: parameter 'ruleset' not known -- typo in config > > > file? [try > > > http://www.rsyslog.com/e/2207 ] > > > > > > 2) Documentation on the rsyslog site says for RELP, the "ruleset" > > > param goes in the module statement: > > > http://www.rsyslog.com/doc/imrelp.html< > > http://www.rsyslog.com/tls-secured-syslog-via-relp/> > > > > > > *Module Parameters*: > > > > > > - *Ruleset* <name> > > > Binds the specified ruleset to *all* RELP listeners > > > > > > > > > > > > > > > > > > > > > > > > On Thu, Aug 15, 2013 at 12:52 PM, David Lang <[email protected]> wrote: > > > > > >> I believe that you would tie a ruleset to an input, not to a > > >> module. Try moving the ruleset line from the module to the input. > > >> > > >> David Lang > > >> > > >> > > >> On Thu, 15 Aug 2013, Xuri Nagarin wrote: > > >> > > >> I see the same errors with 7.4.3 too. > > >>> > > >>> > > >>> > > >>> > > >>> On Thu, Aug 15, 2013 at 11:31 AM, Xuri Nagarin <[email protected]> > > >>> wrote: > > >>> > > >>> I keep running into this error even without tls for RELP: > > >>>> > > >>>> rsyslogd -f /etc/rsyslog.conf -N1 -n > > >>>> rsyslogd: version 7.4.1, config validation run (level 1), master > > config > > >>>> /etc/rsyslog.conf > > >>>> rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on > > >>>> or before line 74: parameter 'ruleset' not known -- typo in > > >>>> config file? [try > > >>>> http://www.rsyslog.com/e/2207 ] > > >>>> rsyslogd: error during parsing file /etc/rsyslog.d/ext.conf, on > > >>>> or before line 75: parameter 'tls' not known -- typo in config > > >>>> file? [try > > >>>> http://www.rsyslog.com/e/2207 ] > > >>>> rsyslogd: End of config validation run. Bye. > > >>>> > > >>>> Config in /etc/rsyslog.d/ext.conf says: > > >>>> > > >>>> module(load="imrelp" ruleset="netlogs") <<--------- Line 74 > > >>>> input(type="imrelp" port="516" tls="off") > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> On Wed, Aug 14, 2013 at 7:02 AM, Rainer Gerhards < > > >>>> [email protected] > > >>>> > > >>>>> wrote: > > >>>>> > > >>>> > > >>>> Run imptcp for plain tcp. Relp tls requires devel. > > >>>>> > > >>>>> Sent from phone, thus brief. > > >>>>> Am 14.08.2013 09:56 schrieb "Radu Gheorghe" > > >>>>> <[email protected] > > >: > > >>>>> > > >>>>> Hello, > > >>>>>> > > >>>>>> If no-one else comes with a better idea, you can use two > > >>>>>> rsyslog > > >>>>>> > > >>>>> processes: > > >>>>> > > >>>>>> one to listen for plain TCP, and the other for TLS-enabled TCP. > > >>>>>> On Aug 13, 2013 11:51 PM, "Xuri Nagarin" <[email protected]> > wrote: > > >>>>>> > > >>>>>> Hi, > > >>>>>>> > > >>>>>>> I am running 7.4.1 (installed from RPMs off the rsyslog site) > > >>>>>>> on > > RHEL > > >>>>>>> > > >>>>>> 6.2 > > >>>>> > > >>>>>> > > >>>>>>> On the server side, I need to receive messages from other > > >>>>>>> Syslog > > (mix > > >>>>>>> > > >>>>>> of > > >>>>> > > >>>>>> rsyslog/syslog-ng) servers in both - TLS and plain TCP. > > >>>>>>> > > >>>>>>> That seems to rule out using the imtcp module with TLS since > > >>>>>>> > > >>>>>> streamdriver > > >>>>> > > >>>>>> parameters seem to be module wide so I cannot have one TCP > port > > >>>>>>> > > >>>>>> listening > > >>>>> > > >>>>>> for plain text and another with TLS. Right? > > >>>>>>> > > >>>>>>> If I try using RELP+TLS (for rsyslog clients), this document > > requires > > >>>>>>> minimum of 7.5.1 that is a Dev branch so I cannot deploy it: > > >>>>>>> http://www.rsyslog.com/using-**tls-with-relp/< > > http://www.rsyslog.com/using-tls-with-relp/> > > >>>>>>> > > >>>>>>> This other document on RELP+TLS should work but it does not > > >>>>>>> tell me > > >>>>>>> > > >>>>>> where > > >>>>> > > >>>>>> to configure key and cert locations: > > >>>>>>> http://www.rsyslog.com/tls-**secured-syslog-via-relp/< > > http://www.rsyslog.com/tls-secured-syslog-via-relp/> > > >>>>>>> > > >>>>>>> Also, rsyslog throws an error - "error during parsing file > > >>>>>>> /etc/rsyslog.d/extend.conf, on or before line 73: parameter > > 'ruleset' > > >>>>>>> > > >>>>>> not > > >>>>> > > >>>>>> known -- typo in config file? [try http://www.rsyslog.com/e/2207 > ]" > > >>>>>>> > > >>>>>>> if I try to configure a imrelp module like this: > > >>>>>>> module(load="imrelp" ruleset="myrule") > > >>>>>>> > > >>>>>>> If I remove the /ruleset/ parameter, rsyslog loads up fine. > > >>>>>>> > > >>>>>>> Does anyone have a similar config that I can use as reference? > > >>>>>>> > > >>>>>>> TIA, > > >>>>>>> > > >>>>>>> Xuri > > >>>>>>> ______________________________**_________________ > > >>>>>>> rsyslog mailing list > > >>>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog< > > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > >>>>>>> http://www.rsyslog.com/**professional-services/< > > http://www.rsyslog.com/professional-services/> > > >>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED > > >>>>>>> by a > > >>>>>>> > > >>>>>> myriad > > >>>>> > > >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > > >>>>>> if > > you > > >>>>>>> DON'T LIKE THAT. > > >>>>>>> > > >>>>>>> ______________________________**_________________ > > >>>>>> rsyslog mailing list > > >>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog< > > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > >>>>>> http://www.rsyslog.com/**professional-services/< > > http://www.rsyslog.com/professional-services/> > > >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by > > >>>>>> a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO > > >>>>>> NOT POST if > > you > > >>>>>> DON'T LIKE THAT. > > >>>>>> > > >>>>>> ______________________________**_________________ > > >>>>> rsyslog mailing list > > >>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog< > > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > >>>>> http://www.rsyslog.com/**professional-services/< > > http://www.rsyslog.com/professional-services/> > > >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by > > >>>>> a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO > > >>>>> NOT POST if > > you > > >>>>> DON'T LIKE THAT. > > >>>>> > > >>>>> > > >>>> > > >>>> ______________________________**_________________ > > >>> rsyslog mailing list > > >>> http://lists.adiscon.net/**mailman/listinfo/rsyslog< > > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > >>> http://www.rsyslog.com/**professional-services/< > > http://www.rsyslog.com/professional-services/> > > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > >>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > myriad > > >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > > >>> you DON'T LIKE THAT. > > >>> > > >>> ______________________________**_________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/**mailman/listinfo/rsyslog< > > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > >> http://www.rsyslog.com/**professional-services/< > > http://www.rsyslog.com/professional-services/> > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > >> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > > >> you DON'T LIKE THAT. > > >> > > > > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
