On Wed, 4 Apr 2018, Rich Megginson via rsyslog wrote:

On 04/04/2018 05:22 PM, David Lang wrote:
I'm trying to use mmkubernetes where the docker containers are logging via journald.

my config is:

module(load="imfile" PollingInterval="10") # provided support for monitoring alternate log files module(load="imuxsock") # provides support for local system logging (e.g. via logger command) module(load="imklog")   # provides kernel logging support (previously done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

I don't see imjournal here?

module(load="mmkubernetes" kubernetesurl="http://k8s-master.lc.dc.openx.org:8080";
  tls.cacert="/etc/ssl/certs/ca-bundle.crt"
  allowunsignedcerts="on"
  token="foobar"
  annotation_match=[".*"]
  filenamerules="rule=:/var/log/containers/"

filenamerules is an array value: https://github.com/rsyslog/rsyslog/blob/master/contrib/mmkubernetes/mmkubernetes.c#L183

That may be causing the crash.

so there is a doc bug: http://www.rsyslog.com/doc/v8-stable/configuration/modules/mmkubernetes.html?highlight=kubernetes#filenamerules


If I remove the filenamerules line, I end up with

6127.976782909:main thread    : rainerscript.c: containerrules: (unset)
6127.976814716:main thread : errmsg.c: Called LogMsg, msg: liblognorm error: rulebase file --NO-FILE--[1]: invalid record type detected: ':/var/log/containers/%pod_name:char-to:.%.%container_hash:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log' rsyslogd: liblognorm error: rulebase file --NO-FILE--[1]: invalid record type detected: ':/var/log/containers/%pod_name:char-to:.%.%container_hash:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log' [v8.34.0 try http://www.rsyslog.com/e/2427 ] 6127.976840359:main thread : errmsg.c: Called LogMsg, msg: liblognorm error: rulebase file --NO-FILE--[1]: invalid record type detected: ':/var/log/containers/%pod_name:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log' rsyslogd: liblognorm error: rulebase file --NO-FILE--[1]: invalid record type detected: ':/var/log/containers/%pod_name:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log' [v8.34.0 try http://www.rsyslog.com/e/2427 ]
Segmentation fault

the config is:

# grep -v '^#' ../rsyslog.conf|grep [a-z]
module(load="imfile" PollingInterval="10") # provided support for monitoring 
alternate log files
module(load="imuxsock") # provides support for local system logging (e.g. via 
logger command)
module(load="imklog")   # provides kernel logging support (previously done by 
rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
module(load="mmkubernetes" kubernetesurl="http://k8s-master.lc.dc.openx.org:8080";
  tls.cacert="/etc/ssl/certs/ca-bundle.crt"
  allowunsignedcerts="on"
  token="foobar"
  annotation_match=[".*"]
)
action(type="mmkubernetes")
stop
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to