I would suspect that something like selinux gets into your way. Does rsyslog emit any error messages? Not sure for 8.24 but systemctl status rsyslogd should show at least some.
Rainer El mar., 27 nov. 2018 a las 3:49, Chad Geary via rsyslog (<[email protected]>) escribió: > > Hello, > > I've recently setup a new rsyslog server using a few modules (ommail > and ommysql specifically). I noticed my mail messages are not sent > (but queued) when starting rsyslogd with systemctl start rsyslog. > > If I start rsyslog via '/usr/sbin/rsyslogd' the queued emails will be > sent (as will subsequent emails as defined by rsyslog.conf). > > In both cases the mysql inserts are working as intended. > > RHEL7.6 > rsyslogd 8.24.0-34.el7, compiled with: > PLATFORM: x86_64-redhat-linux-gnu > PLATFORM (lsb_release -d): > FEATURE_REGEXP: Yes > GSSAPI Kerberos 5 support: Yes > FEATURE_DEBUG (debug build, slow code): No > 32bit Atomic operations supported: Yes > 64bit Atomic operations supported: Yes > memory allocator: system default > Runtime Instrumentation (slow code): No > uuid support: Yes > Number of Bits in RainerScript integers: 64 > > /etc/rsyslog.conf > # modules > $ModLoad imuxsock # local > $ModLoad imklog # kernel > $ModLoad ommail # email > $ModLoad ommysql # mysql > $ModLoad imtcp # tcp reception > $InputTCPServerRun 514 > > # daemon conf > $WorkDirectory /opt/rsyslog/work # db queue files > $ActionQueueType LinkedList # use asynchronous processing > $ActionQueueFileName dbq # set file name, also enables disk mode > $ActionResumeRetryCount -1 # infinite retries on insert failure > $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) > $ActionQueueSaveOnShutdown on # save messages to disk on shutdown > > # mail alert 1 - auth (failed pass) > $ActionMailSMTPServer [hidden] > $ActionMailFrom rsyslog@[hidden] > $ActionMailTo [hidden] > $template mailSubject1,"syslog: auth alert @ %hostname%" > $template mailBody1,"%msg%" > $ActionMailSubject mailSubject1 > $ActionExecOnlyOnceEveryInterval 5 > # all one line! > if $rawmsg contains 'Failed pass' then :ommail:;mailBody1 > # allow other actions to continue > $ActionExecOnlyOnceEveryInterval 0 > > # mail alert 2 - sys (etc) > $ActionMailSMTPServer [hidden] > $ActionMailFrom [hidden] > $ActionMailTo [hidden] > $template mailSubject2,"syslog: sys alert @ %hostname%" > $template mailBody2,"%rawmsg%" > $ActionMailSubject mailSubject2 > $ActionExecOnlyOnceEveryInterval 5 > # all one line! > if ($rawmsg startswith 'Kernel' or $rawmsg startswith 'kernel' or $msg > contains 'mountd: refused' or $msg contains 'No space left') then > :ommail:;mailBody2 > # allow other actions to continue > $ActionExecOnlyOnceEveryInterval 0 > > # filter/drop > :rawmsg, contains, "Connection from UDP" stop > :rawmsg, contains, "Received SNMP packet(s) " stop > > # log everything else to db (haproxy) > *.* :ommysql:127.0.0.1,Syslog,[hidden],[hidden] > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
