I found an older version i had laying around of mmnormalize which works with the updated 8.17: #sha1sum /lib64/rsyslog/mmnormalize.so 77b332747b539d1eb4e88ea043bc014781eb31bc /lib64/rsyslog/mmnormalize.so
This .so file works with the new 8.17 binaries, whereas the yum installed mmnormalize.so file does not. If anyone else is having the same issue, i can share the older mmnormalize.so file i've saved. Is this a more widely spread problem, or did I just luck out? Cheers, JB On Wed, Mar 9, 2016 at 1:33 PM, Joe Blow <[email protected]> wrote: > Hey all, > > After the update to 8.17 to fix this, i'm now getting this when > mmnormalize loads: > > rsyslogd-2066: could not load module '/lib64/rsyslog/mmnormalize.so', > dlopen: /lib64/rsyslog/mmnormalize.so: undefined symbol: ln_setErrMsgCB > [v8.17.0 try http://www.rsyslog.com/e/2066 ] > > Any fix? This basically broke our elasticsearch parsing. > > Thanks in advance. > > Cheers, > > JB > > On Wed, Mar 2, 2016 at 12:12 PM, Rainer Gerhards <[email protected] > > wrote: > >> 2016-03-02 16:51 GMT+01:00 Peter Portante <[email protected]>: >> > And it appears to also affect the "$date-ordinal" property. Can you >> > confirm? >> >> Yeah, right because it uses the same helper function. But so the same >> fix fixes that issue as well. But... having said that, it's probably >> better to add some tests for it to the testbench as well. >> >> Thanks for bringing it up. >> >> Rainer >> > >> > On Wed, Mar 2, 2016 at 10:47 AM, Peter Portante < >> [email protected]> >> > wrote: >> > >> >> Hi Rainer, >> >> >> >> Does this also affect ommongodb use? >> >> >> >> -peter >> >> >> >> >> >> On Wed, Mar 2, 2016 at 6:11 AM, Rainer Gerhards < >> [email protected]> >> >> wrote: >> >> >> >>> Hi all, >> >>> >> >>> I just wanted to let you know that we have found an issue with the >> >>> unixtimestamp formatting option in leap years. The problem started on >> >>> March, 1st and will persist till the end of the year. The timestamp is >> >>> one day in the past. >> >>> >> >>> A patch is available here, it shall probably work with almost all >> >>> rsyslog versions: >> >>> >> >>> >> https://github.com/rgerhards/rsyslog/commit/ffb321f1698a971e0acda48cafa97bb344cf0829 >> >>> >> >>> Full details can be found in this issue tracker: >> >>> https://github.com/rsyslog/rsyslog/issues/830 >> >>> >> >>> Note that I will NOT release a 8.16.1 version for this fix. Usually, I >> >>> would have done so, but the 8.17.0 release is due next Tuesday and >> >>> will probably available as RC on friday. Given the fact that I would >> >>> need at least one additional day to craft 8.16.1, I don't think this >> >>> makes much sense. >> >>> >> >>> Distro packages (and other users as well, of course) can apply >> >>> above-mentioned short patch. I actually suggest to do so, as this >> >>> problem exists, I think, in all versions supporting the >> >>> "unixtimestamp" formatting option (side-note: v5.8 does not have this >> >>> option). >> >>> >> >>> Rainer >> >>> _______________________________________________ >> >>> rsyslog mailing list >> >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >> >>> http://www.rsyslog.com/professional-services/ >> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >> >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad >> >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> >>> DON'T LIKE THAT. >> >>> >> >> >> >> >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> you DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
