first off, version 5.8.11 is long out of support by the community, it's very
possible that this feature was added after that point. The "did you forget to
load a module" error is the generic error for anything that it doesn't
understand.
the 5.x series got to 5.10.something.
doing some digging, 5.8.11 was released in May 2012, it looks like
SocketAnnotate showed up in July 2012.
David Lang
On Fri, 28 Aug 2015, David Spautz wrote:
Date: Fri, 28 Aug 2015 16:27:03 +0100
From: David Spautz <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] Rsyslog 5.8.11 and imuxsocket SystemLogSocketAnnotate not
working
Hi all,
I tried to use imuxsock.so and and Annotation or better
Trusted-Properties feature for some filter. But on rsyslog startup I get
following errors:
Aug 28 10:49:34 test kernel: imklog 5.8.11, log source = /proc/kmsg started.
Aug 28 10:49:34 test rsyslogd: [origin software="rsyslogd"
swVersion="5.8.11" x-pid="2996" x-info="http://www.rsyslog.com";] start
Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file
command - have you forgotten to load a module? [try
http://www.rsyslog.com/e/3003 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 25:"$SystemLogSocketAnnotate on"
Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file
command - have you forgotten to load a module? [try
http://www.rsyslog.com/e/3003 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 26:"$SystemLogParseTrusted on"
Aug 28 10:49:34 test rsyslogd-2051: syntax error in expression [try
http://www.rsyslog.com/e/2051 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 128:"if $!uid == '1000' then /var/log/nobody.log"
Aug 28 10:49:34 test rsyslogd: warning: selector line without actions
will be discarded
Aug 28 10:49:34 test rsyslogd-2124: CONFIG ERROR: could not interpret
master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
My rsyslog.conf:
$ModLoad imuxsock.so # provides support for local system logging
$ModLoad imklog # provides kernel logging support
$SystemLogSocketAnnotate on
$SystemLogParseTrusted on
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
if $!uid == '1000' then /var/log/nobody.log
Why rsyslog cant find the config file commands. It works with rsyslog 8.
I use a debian 7 wheezy. Which modules I forgot to load? How can I do
these filter with rsyslog 5.8.11 under debian 7? This feature should be
available
http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html
Thanks you so much
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
