Hi all, I tried to use imuxsock.so and and Annotation or better Trusted-Properties feature for some filter. But on rsyslog startup I get following errors:
Aug 28 10:49:34 test kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 28 10:49:34 test rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2996" x-info="http://www.rsyslog.com";] start Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ] Aug 28 10:49:34 test rsyslogd: the last error occured in /etc/rsyslog.conf, line 25:"$SystemLogSocketAnnotate on" Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ] Aug 28 10:49:34 test rsyslogd: the last error occured in /etc/rsyslog.conf, line 26:"$SystemLogParseTrusted on" Aug 28 10:49:34 test rsyslogd-2051: syntax error in expression [try http://www.rsyslog.com/e/2051 ] Aug 28 10:49:34 test rsyslogd: the last error occured in /etc/rsyslog.conf, line 128:"if $!uid == '1000' then /var/log/nobody.log" Aug 28 10:49:34 test rsyslogd: warning: selector line without actions will be discarded Aug 28 10:49:34 test rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ] My rsyslog.conf: $ModLoad imuxsock.so # provides support for local system logging $ModLoad imklog # provides kernel logging support $SystemLogSocketAnnotate on $SystemLogParseTrusted on $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $WorkDirectory /var/spool/rsyslog $IncludeConfig /etc/rsyslog.d/*.conf if $!uid == '1000' then /var/log/nobody.log Why rsyslog cant find the config file commands. It works with rsyslog 8. I use a debian 7 wheezy. Which modules I forgot to load? How can I do these filter with rsyslog 5.8.11 under debian 7? This feature should be available http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html Thanks you so much On 27/08/15 07:59, Rainer Gerhards wrote: > 2015-08-26 22:40 GMT+02:00 rmkml <[email protected]>: >> Hi, >> >> Enable keepalive on imtcp module like this: >> module(load="imtcp" KeepAlive="on") >> input(address="127.0.0.1" type="imtcp" port="514") >> >> but enable keepalive on imptcp module like this: >> module(load="imptcp") >> input(KeepAlive="on" address="127.0.0.1" type="imptcp" port="514") >> >> Yes keepalive option is config different on two module ;) > yup, that's how they evolved. We could add one option to the other, > but we need to keep the old ones around to not break anything. I don't > think that gains us so much except more complex code. > > Rainer >> Tested on v8.12.0. >> >> Just my $0.2 >> >> Regards >> @Rmkml >> >> http://www.rsyslog.com/doc/master/configuration/modules/imptcp.html >> http://www.rsyslog.com/doc/master/configuration/modules/imtcp.html >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. -- David Spautz Consultant credativ Ltd Suite 5, Bloxam Court CV21 2DU UK office: +44 1788 298150 Email: [email protected] Web: http://www.credativ.co.uk -- credativ Ltd is registered in England & Wales, company no. 5261743 Certified by CompTIA / AccredIT UK with the ICT Supply standard of quality for Software Product Design and Development _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
