Hi all, I tried to use imuxsock.so and and Annotation or better Trusted-Properties feature for some filter. But on rsyslog startup I get following errors:
Aug 28 10:49:34 test kernel: imklog 5.8.11, log source = /proc/kmsg started. Aug 28 10:49:34 test rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2996" x-info="http://www.rsyslog.com";] start Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ] Aug 28 10:49:34 test rsyslogd: the last error occured in /etc/rsyslog.conf, line 25:"$SystemLogSocketAnnotate on" Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ] Aug 28 10:49:34 test rsyslogd: the last error occured in /etc/rsyslog.conf, line 26:"$SystemLogParseTrusted on" Aug 28 10:49:34 test rsyslogd-2051: syntax error in expression [try http://www.rsyslog.com/e/2051 ] Aug 28 10:49:34 test rsyslogd: the last error occured in /etc/rsyslog.conf, line 128:"if $!uid == '1000' then /var/log/nobody.log" Aug 28 10:49:34 test rsyslogd: warning: selector line without actions will be discarded Aug 28 10:49:34 test rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ] My rsyslog.conf: $ModLoad imuxsock.so # provides support for local system logging $ModLoad imklog # provides kernel logging support $SystemLogSocketAnnotate on $SystemLogParseTrusted on $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $WorkDirectory /var/spool/rsyslog $IncludeConfig /etc/rsyslog.d/*.conf if $!uid == '1000' then /var/log/nobody.log Why rsyslog cant find the config file commands. It works with rsyslog 8. I use a debian 7 wheezy. Which modules I forgot to load? How can I do these filter with rsyslog 5.8.11 under debian 7? This feature should be available http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html Thanks you so much -- David Spautz Consultant credativ Ltd Suite 5, Bloxam Court CV21 2DU UK office: +44 1788 298150 Email: [email protected] Web: http://www.credativ.co.uk -- credativ Ltd is registered in England & Wales, company no. 5261743 Certified by CompTIA / AccredIT UK with the ICT Supply standard of quality for Software Product Design and Development _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
