[rsyslog] ommail - messages are not sent when spawned via systemd

Rainer Gerhards

2018-11-27 07:29:09 UTC

I would suspect that something like selinux gets into your way.

Does rsyslog emit any error messages? Not sure for 8.24 but systemctl
status rsyslogd should show at least some.

Rainer
El mar., 27 nov. 2018 a las 3:49, Chad Geary via rsyslog

Post by Chad Geary via rsyslog
Hello,
I've recently setup a new rsyslog server using a few modules (ommail
and ommysql specifically). I noticed my mail messages are not sent
(but queued) when starting rsyslogd with systemctl start rsyslog.
If I start rsyslog via '/usr/sbin/rsyslogd' the queued emails will be
sent (as will subsequent emails as defined by rsyslog.conf).
In both cases the mysql inserts are working as intended.
RHEL7.6
PLATFORM: x86_64-redhat-linux-gnu
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64
/etc/rsyslog.conf
# modules
$ModLoad imuxsock # local
$ModLoad imklog # kernel
$ModLoad ommail # email
$ModLoad ommysql # mysql
$ModLoad imtcp # tcp reception
$InputTCPServerRun 514
# daemon conf
$WorkDirectory /opt/rsyslog/work # db queue files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName dbq # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
# mail alert 1 - auth (failed pass)
$ActionMailSMTPServer [hidden]
$ActionMailTo [hidden]
$template mailBody1,"%msg%"
$ActionMailSubject mailSubject1
$ActionExecOnlyOnceEveryInterval 5
# all one line!
if $rawmsg contains 'Failed pass' then :ommail:;mailBody1
# allow other actions to continue
$ActionExecOnlyOnceEveryInterval 0
# mail alert 2 - sys (etc)
$ActionMailSMTPServer [hidden]
$ActionMailFrom [hidden]
$ActionMailTo [hidden]
$template mailBody2,"%rawmsg%"
$ActionMailSubject mailSubject2
$ActionExecOnlyOnceEveryInterval 5
# all one line!
if ($rawmsg startswith 'Kernel' or $rawmsg startswith 'kernel' or $msg
contains 'mountd: refused' or $msg contains 'No space left') then
:ommail:;mailBody2
# allow other actions to continue
$ActionExecOnlyOnceEveryInterval 0
# filter/drop
:rawmsg, contains, "Connection from UDP" stop
:rawmsg, contains, "Received SNMP packet(s) " stop
# log everything else to db (haproxy)
*.* :ommysql:127.0.0.1,Syslog,[hidden],[hidden]
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you