On 04/04/2018 08:05 PM, Rich Megginson via rsyslog wrote:
On 04/04/2018 07:51 PM, David Lang wrote:On Wed, 4 Apr 2018, Rich Megginson wrote:On 04/04/2018 07:18 PM, David Lang wrote:On Wed, 4 Apr 2018, Rich Megginson wrote:On 04/04/2018 06:42 PM, David Lang wrote:On Wed, 4 Apr 2018, Rich Megginson wrote:Stacktrace?a bit hard to get (things are being run on a production machine after umpteen layers of automation)here's what I can get so farok - so definitely something wrong with the filenamerules parsing.possibly my error, I had the filenamerules split into two lines and didn't catch it. does this look any better?looks better (at least, looks like what I would expect an Array configuration parameter to look like) but still crashing.oh well - I guess I should have tested with rules - I did all of my testing with liblognorm 2.0.2 which makes mmkubernetes not use the rules parameters .Is there a way to not use them with later versions?Yes, but apparently not without crashing . . .
Try defining both filenamerulebase and containerrulebase:module(load="mmkubernetes" kubernetesurl="http://k8s-master.lc.dc.openx.org:8080"
token="foobar" filenamerulebase="/etc/rsyslog.d/k8s_filename.rulebase" containerrulebase="/etc/rsyslog.d/k8s_container_name.rulebase" )Using the rulebase files from https://github.com/rsyslog/rsyslog/tree/master/contrib/mmkubernetes
I'm (initially) trying to use this module with data arriving via imjournal, so whatever is in them won't be used.module(load="imfile" PollingInterval="10") # provided support for monitoring alternate log files module(load="imuxsock") # provides support for local system logging (e.g. via logger command) module(load="imklog") # provides kernel logging support (previously done by rklogd)$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat module(load="imjournal" PersistStateInterval="100")module(load="mmkubernetes" kubernetesurl="http://k8s-master.lc.dc.openx.org:8080"token="foobar" filenamerules=["rule=:/just/some/junk"] ) action(type="mmkubernetes") here is the tail end of an strace, why is it loading libregex?It uses regex to parse the annotations/labels, but you aren't using them because you didn't define a pattern. So there is this code:DEFobjCurrIf(regexp) ... BEGINmodInit() CODESTARTmodInit*ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */CODEmodInit_QueryRegCFSLineHdlrDBGPRINTF("mmkubernetes: module compiled with rsyslog version %s.\n", VERSION);CHKiRet(objUse(errmsg, CORE_COMPONENT)); CHKiRet(objUse(regexp, LM_REGEXP_FILENAME)); Does that cause lmregexp.so to be loaded?open("/usr/lib64/rsyslog/mmkubernetes.so", O_RDONLY|O_CLOEXEC) = 4read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300#\0\0\0\0\0\0"..., 832) = 832fstat(4, {st_mode=S_IFREG|0755, st_size=36712, ...}) = 0mmap(NULL, 2130696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f5cc759b000mprotect(0x7f5cc75a3000, 2093056, PROT_NONE) = 0mmap(0x7f5cc77a2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7000) = 0x7f5cc77a2000close(4) = 0open("/usr/lib64/tls/liblognorm.so.5", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)open("/usr/lib64/liblognorm.so.5", O_RDONLY|O_CLOEXEC) = 4read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20X\0\0\0\0\0\0"..., 832) = 832fstat(4, {st_mode=S_IFREG|0755, st_size=144072, ...}) = 0mmap(NULL, 2237600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f5cc7378000mprotect(0x7f5cc7399000, 2097152, PROT_NONE) = 0mmap(0x7f5cc7599000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x21000) = 0x7f5cc7599000close(4) = 0 mprotect(0x7f5cc7599000, 4096, PROT_READ) = 0 mprotect(0x7f5cc77a2000, 4096, PROT_READ) = 0 open("/usr/lib64/rsyslog/lmregexp.so", O_RDONLY|O_CLOEXEC) = 4read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\10\0\0\0\0\0\0"..., 832) = 832fstat(4, {st_mode=S_IFREG|0755, st_size=7064, ...}) = 0mmap(NULL, 2101392, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f5cc7176000mprotect(0x7f5cc7177000, 2093056, PROT_NONE) = 0mmap(0x7f5cc7376000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0) = 0x7f5cc7376000close(4) = 0 mprotect(0x7f5cc7376000, 4096, PROT_READ) = 0 gettid() = 14269rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7f5cce0155e0}, NULL, 8) = 0brk(NULL) = 0x558c751d4000 brk(0x558c751f5000) = 0x558c751f5000 brk(NULL) = 0x558c751f5000 brk(NULL) = 0x558c751f5000 brk(0x558c751f4000) = 0x558c751f4000 brk(NULL) = 0x558c751f4000 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0} --- +++ killed by SIGSEGV (core dumped) +++ Segmentation faultI'm going to be offline for an hour or so while I drive home. I'll check my e-mail after I get home and can VPN to the office to continue troubleshooting.Thanks for your help. David Lang_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhardsNOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.