2014-11-20 15:59 GMT+01:00 Rainer Gerhards <[email protected]>:
> As it looks, this does the trick: > > > https://github.com/rsyslog/rsyslog/commit/4cc10e7434d21f98e5cacd542edb834f894db620 > > It's currently in master-candidate and will migrate to master when the > testruns look good (the manual one did). > > Totally empty configs are still not tolerated. I'll see if I can add an > option for that. > > I have now extended the -N option to support -N3, which can be used for checking include files: https://github.com/rsyslog/rsyslog/commit/a75eb98c058665d82f168f834b392683b30e001d It does not require the existence of actions. Rainer > Rainer > > 2014-11-19 20:07 GMT+01:00 Brian Knox <[email protected]>: > >> Thanks! >> >> On Wed, Nov 19, 2014 at 1:59 PM, Rainer Gerhards < >> [email protected]> >> wrote: >> >> > Ok then I need to see how I can fiddle that into the grammar ;) >> > >> > Sent from phone, thus brief. >> > Am 19.11.2014 19:56 schrieb "David Lang" <[email protected]>: >> > >> > > On Wed, 19 Nov 2014, Rainer Gerhards wrote: >> > > >> > > 2014-11-19 16:40 GMT+01:00 Brian Knox <[email protected]>: >> > >> >> > >> Ok - perhaps we have accidently conflated two problems: >> > >>> >> > >>> 1) An empty ruleset >> > >>> 2) A ruleset with only "stop" >> > >>> >> > >>> this will pass validation: >> > >>> >> > >>> ------------------------------------ >> > >>> ruleset(name="foo") { >> > >>> stop >> > >>> } >> > >>> *.* /var/log/test >> > >>> call foo >> > >>> ------------------------------------ >> > >>> >> > >>> If the ruleset is empty, however, it will not: >> > >>> >> > >>> ------------------------------------ >> > >>> ruleset(name="foo") { >> > >>> } >> > >>> *.* /var/log/test >> > >>> call foo >> > >>> ------------------------------------ >> > >>> >> > >>> rsyslogd: version 8.5.0, config validation run (level 1), master >> config >> > >>> ./test.conf >> > >>> rsyslogd: error during parsing file ./test.conf, on or before line >> 2: >> > >>> syntax error on token '}' [try http://www.rsyslog.com/e/2207 ] >> > >>> rsyslogd: CONFIG ERROR: could not interpret master config file >> > >>> './test.conf'. [try http://www.rsyslog.com/e/2207 ] >> > >>> rsyslogd: run failed with error -2207 (see rsyslog.h or try >> > >>> http://www.rsyslog.com/e/2207 to learn what that number means) >> > >>> >> > >>> >> > >>> OK, that's a different question. Is the consensus we need to >> support >> > >> this >> > >> as well? >> > >> >> > > >> > > I think so, with a warning reported at startup or something like that. >> > > >> > > David Lang >> > > >> > > Rainer >> > >> >> > >> >> > >> Brian >> > >>> >> > >>> >> > >>> >> > >>> On Wed, Nov 19, 2014 at 10:35 AM, Brian Knox < >> [email protected]> >> > >>> wrote: >> > >>> >> > >>> For verifying the problem I ran rsyslog -N1 -f against just the >> subset >> > >>>> of >> > >>>> the config, if I recall correctly. I believe my coworker had the >> same >> > >>>> issue with the full config that definitely had actions in it - but >> > I'll >> > >>>> >> > >>> ask >> > >>> >> > >>>> him to reproduce with the full configuration. Thanks! >> > >>>> >> > >>>> Brian >> > >>>> >> > >>>> On Wed, Nov 19, 2014 at 10:13 AM, Rainer Gerhards < >> > >>>> [email protected]> wrote: >> > >>>> >> > >>>> Brian, >> > >>>>> >> > >>>>> I just revisited this problem report. I have now taken a look at >> the >> > >>>>> >> > >>>> code. >> > >>> >> > >>>> The error message actually tells you that there is no action inside >> > the >> > >>>>> *entire config*, not just an empty ruleset. Can you confirm there >> was >> > >>>>> nothing else in the config? If not, can you send me the config, so >> > that >> > >>>>> >> > >>>> I >> > >>> >> > >>>> can try to see what's going on. >> > >>>>> >> > >>>>> I assume we agree that a totally action-less config is an error ;) >> > >>>>> >> > >>>>> Rainer >> > >>>>> >> > >>>>> 2014-11-11 22:49 GMT+01:00 Brian Knox <[email protected]>: >> > >>>>> >> > >>>>> If was able to use an empty ruleset, a warning resulting from >> that >> > >>>>>> >> > >>>>> wouldn't >> > >>>>> >> > >>>>>> bother me at all. >> > >>>>>> >> > >>>>>> Brian >> > >>>>>> >> > >>>>>> On Tue, Nov 11, 2014 at 4:25 PM, David Lang <[email protected]> >> wrote: >> > >>>>>> >> > >>>>>> On Tue, 11 Nov 2014, Rainer Gerhards wrote: >> > >>>>>>> >> > >>>>>>> 2014-11-11 17:22 GMT+01:00 David Lang <[email protected]>: >> > >>>>>>> >> > >>>>>>>> >> > >>>>>>>> On Tue, 11 Nov 2014, Brian Knox wrote: >> > >>>>>>>> >> > >>>>>>>>> >> > >>>>>>>>> Rainer, >> > >>>>>>>>> >> > >>>>>>>>> >> > >>>>>>>>>> I agree that an empty ruleset is an oddity. In our case, the >> > >>>>>>>>>> >> > >>>>>>>>> short >> > >>> >> > >>>> answer >> > >>>>>>>>>> is that we are generating configurations from templates using >> > >>>>>>>>>> >> > >>>>>>>>> chef, >> > >>> >> > >>>> and >> > >>>>>> >> > >>>>>>> the >> > >>>>>>>>>> ability to have a ruleset that simply discards would make >> part >> > of >> > >>>>>>>>>> >> > >>>>>>>>> that >> > >>>>> >> > >>>>>> process much simpler for us. >> > >>>>>>>>>> >> > >>>>>>>>>> It is admittedly an edge case. >> > >>>>>>>>>> >> > >>>>>>>>>> >> > >>>>>>>>>> It's an edge case, but I think it's one that should be >> > supported >> > >>>>>>>>> >> > >>>>>>>> if >> > >>> >> > >>>> possible. >> > >>>>>>>>> >> > >>>>>>>>> automated config generation is very useful, and being able to >> > >>>>>>>>> >> > >>>>>>>> group >> > >>> >> > >>>> rules >> > >>>>>> >> > >>>>>>> into rulesets and call them with the calling function not having >> > >>>>>>>>> >> > >>>>>>>> any >> > >>> >> > >>>> idea >> > >>>>>> >> > >>>>>>> of what is going to happen with the logs at that point is very >> > >>>>>>>>> >> > >>>>>>>> useful, >> > >>>>> >> > >>>>>> being able to have a high level config split the logs up and call >> > >>>>>>>>> different >> > >>>>>>>>> rulesets on different logs without having to worry if the >> ruleset >> > >>>>>>>>> >> > >>>>>>>> does >> > >>>>> >> > >>>>>> something with the logs or just throws them away is _very_ >> useful. >> > >>>>>>>>> >> > >>>>>>>>> So it is a corner case, but I think it's a valuable one to >> > >>>>>>>>> >> > >>>>>>>> support. >> > >>> >> > >>>> >> > >>>>>>>>> >> > >>>>>>>>> ack >> > >>>>>>>>> >> > >>>>>>>> >> > >>>>>>>> >> > >>>>>>>> I would suggest that at config load time, that this is an odd >> > >>>>>>>> >> > >>>>>>> enough >> > >>> >> > >>>> corner case that it's worth logging a "ruleset X can't do anything >> > >>>>>>>>> >> > >>>>>>>> with >> > >>>>> >> > >>>>>> the >> > >>>>>>>>> logs" message, not just for the case where the only action is >> to >> > >>>>>>>>> >> > >>>>>>>> throw >> > >>>>> >> > >>>>>> it >> > >>>>>> >> > >>>>>>> away, but also for the cases where the conditions in a ruleset >> > >>>>>>>>> >> > >>>>>>>> cannot >> > >>>>> >> > >>>>>> possibly match any log message (if priority = info then *.crit >> > >>>>>>>>> >> > >>>>>>>> also >> > >>> >> > >>>> cannot >> > >>>>>>>>> match anything for example) >> > >>>>>>>>> >> > >>>>>>>>> >> > >>>>>>>>> Let's start with what we have on the table. I think it is >> best >> > to >> > >>>>>>>>> >> > >>>>>>>> add >> > >>>>> >> > >>>>>> a >> > >>>>>> >> > >>>>>>> ruleset parameter "permitEmpty=on". That way, we don't generate >> > >>>>>>>> error/warning messages when the user is aware of what he is >> doing. >> > >>>>>>>> >> > >>>>>>> In >> > >>> >> > >>>> any >> > >>>>>> >> > >>>>>>> manual case (without config gen), I'd still say that's an error >> > >>>>>>>> indication. >> > >>>>>>>> >> > >>>>>>>> >> > >>>>>>> I think that this is a sufficently corner case that I'm not sure >> > >>>>>>> >> > >>>>>> it's >> > >>> >> > >>>> worth the extra complexity to silence the warning. I think that >> > >>>>>>> >> > >>>>>> people >> > >>> >> > >>>> who >> > >>>>>> >> > >>>>>>> do this intentionally can just ignore the log message. >> > >>>>>>> >> > >>>>>>> On the topic of no filter matches. That's quite complex, as you >> > >>>>>>> >> > >>>>>> would >> > >>> >> > >>>> need >> > >>>>>> >> > >>>>>>> to evaluate all the filters and possible conditions. Not sure >> if it >> > >>>>>>>> >> > >>>>>>> can >> > >>>>> >> > >>>>>> even reliably done. Am I overlooking something? >> > >>>>>>>> >> > >>>>>>>> >> > >>>>>>> I am not saying that it should try to catch every possible case, >> > >>>>>>> >> > >>>>>> but I >> > >>> >> > >>>> was >> > >>>>>> >> > >>>>>>> thinking that the configuration optimization step would >> "optomize >> > >>>>>>> >> > >>>>>> away" >> > >>>>> >> > >>>>>> some impossible combinations, and that could result in an empty >> > >>>>>>> >> > >>>>>> ruleset. >> > >>>>> >> > >>>>>> >> > >>>>>>> David Lang >> > >>>>>>> >> > >>>>>>> _______________________________________________ >> > >>>>>>> rsyslog mailing list >> > >>>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >> > >>>>>>> http://www.rsyslog.com/professional-services/ >> > >>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >> > >>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by >> a >> > >>>>>>> >> > >>>>>> myriad >> > >>>>> >> > >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST >> if >> > >>>>>>> >> > >>>>>> you >> > >>> >> > >>>> DON'T LIKE THAT. >> > >>>>>>> >> > >>>>>>> _______________________________________________ >> > >>>>>> rsyslog mailing list >> > >>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >> > >>>>>> http://www.rsyslog.com/professional-services/ >> > >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >> > >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> > >>>>>> >> > >>>>> myriad >> > >>> >> > >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> you >> > >>>>>> DON'T LIKE THAT. >> > >>>>>> >> > >>>>>> _______________________________________________ >> > >>>>> rsyslog mailing list >> > >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >> > >>>>> http://www.rsyslog.com/professional-services/ >> > >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >> > >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> > >>>>> myriad >> > >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> > you >> > >>>>> DON'T LIKE THAT. >> > >>>>> >> > >>>>> >> > >>>> >> > >>>> _______________________________________________ >> > >>> rsyslog mailing list >> > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >> > >>> http://www.rsyslog.com/professional-services/ >> > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >> > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> > myriad >> > >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> you >> > >>> DON'T LIKE THAT. >> > >>> >> > >>> _______________________________________________ >> > >> rsyslog mailing list >> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> > >> http://www.rsyslog.com/professional-services/ >> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad >> > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> you >> > >> DON'T LIKE THAT. >> > >> >> > >> _______________________________________________ >> > > rsyslog mailing list >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > > http://www.rsyslog.com/professional-services/ >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad >> > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > > DON'T LIKE THAT. >> > > >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > DON'T LIKE THAT. >> > >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
