[rsyslog] keepalive diff on imtcp and imptcp module

Discussion:

rmkml

2015-08-26 20:40:58 UTC

Hi,

Enable keepalive on imtcp module like this:
module(load="imtcp" KeepAlive="on")
input(address="127.0.0.1" type="imtcp" port="514")

but enable keepalive on imptcp module like this:
module(load="imptcp")
input(KeepAlive="on" address="127.0.0.1" type="imptcp" port="514")

Yes keepalive option is config different on two module ;)

Tested on v8.12.0.

Just my $0.2

Regards
@Rmkml

http://www.rsyslog.com/doc/master/configuration/modules/imptcp.html
http://www.rsyslog.com/doc/master/configuration/modules/imtcp.html
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Rainer Gerhards

2015-08-27 06:59:19 UTC

Permalink

Post by rmkml
Hi,
module(load="imtcp" KeepAlive="on")
input(address="127.0.0.1" type="imtcp" port="514")
module(load="imptcp")
input(KeepAlive="on" address="127.0.0.1" type="imptcp" port="514")
Yes keepalive option is config different on two module ;)

yup, that's how they evolved. We could add one option to the other,
but we need to keep the old ones around to not break anything. I don't
think that gains us so much except more complex code.

Rainer

Post by rmkml
Tested on v8.12.0.
Just my $0.2
Regards
@Rmkml
http://www.rsyslog.com/doc/master/configuration/modules/imptcp.html
http://www.rsyslog.com/doc/master/configuration/modules/imtcp.html
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

David Spautz

2015-08-28 15:25:07 UTC

Permalink

Hi all,

I tried to use imuxsock.so and and Annotation or better
Trusted-Properties feature for some filter. But on rsyslog startup I get
following errors:

Aug 28 10:49:34 test kernel: imklog 5.8.11, log source = /proc/kmsg started.
Aug 28 10:49:34 test rsyslogd: [origin software="rsyslogd"
swVersion="5.8.11" x-pid="2996" x-info="http://www.rsyslog.com"] start
Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file
command - have you forgotten to load a module? [try
http://www.rsyslog.com/e/3003 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 25:"$SystemLogSocketAnnotate on"
Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file
command - have you forgotten to load a module? [try
http://www.rsyslog.com/e/3003 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 26:"$SystemLogParseTrusted on"
Aug 28 10:49:34 test rsyslogd-2051: syntax error in expression [try
http://www.rsyslog.com/e/2051 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 128:"if $!uid == '1000' then /var/log/nobody.log"
Aug 28 10:49:34 test rsyslogd: warning: selector line without actions
will be discarded
Aug 28 10:49:34 test rsyslogd-2124: CONFIG ERROR: could not interpret
master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]

My rsyslog.conf:

$ModLoad imuxsock.so # provides support for local system logging
$ModLoad imklog # provides kernel logging support

$SystemLogSocketAnnotate on
$SystemLogParseTrusted on

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

if $!uid == '1000' then /var/log/nobody.log

Why rsyslog cant find the config file commands. It works with rsyslog 8.
I use a debian 7 wheezy. Which modules I forgot to load? How can I do
these filter with rsyslog 5.8.11 under debian 7? This feature should be
available
http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html

Thanks you so much

Post by Rainer Gerhards

yup, that's how they evolved. We could add one option to the other,
but we need to keep the old ones around to not break anything. I don't
think that gains us so much except more complex code.
Rainer

--
David Spautz
Consultant
credativ Ltd
Suite 5, Bloxam Court

CV21 2DU

UK office: +44 1788 298150
Email: ***@credativ.co.uk
Web: http://www.credativ.co.uk
--
credativ Ltd is registered in England & Wales, company no. 5261743
Certified by CompTIA / AccredIT UK with the ICT Supply standard of
quality for Software Product Design and Development

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

David Spautz

2015-08-28 15:27:03 UTC

Permalink

David Lang

2015-08-28 15:48:33 UTC

Permalink

first off, version 5.8.11 is long out of support by the community, it's very
possible that this feature was added after that point. The "did you forget to
load a module" error is the generic error for anything that it doesn't
understand.

the 5.x series got to 5.10.something.

doing some digging, 5.8.11 was released in May 2012, it looks like
SocketAnnotate showed up in July 2012.

David Lang

Date: Fri, 28 Aug 2015 16:27:03 +0100
Subject: [rsyslog] Rsyslog 5.8.11 and imuxsocket SystemLogSocketAnnotate not
working
Hi all,
I tried to use imuxsock.so and and Annotation or better
Trusted-Properties feature for some filter. But on rsyslog startup I get
Aug 28 10:49:34 test kernel: imklog 5.8.11, log source = /proc/kmsg started.
Aug 28 10:49:34 test rsyslogd: [origin software="rsyslogd"
swVersion="5.8.11" x-pid="2996" x-info="http://www.rsyslog.com"] start
Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file
command - have you forgotten to load a module? [try
http://www.rsyslog.com/e/3003 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 25:"$SystemLogSocketAnnotate on"
Aug 28 10:49:34 test rsyslogd-3003: invalid or yet-unknown config file
command - have you forgotten to load a module? [try
http://www.rsyslog.com/e/3003 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 26:"$SystemLogParseTrusted on"
Aug 28 10:49:34 test rsyslogd-2051: syntax error in expression [try
http://www.rsyslog.com/e/2051 ]
Aug 28 10:49:34 test rsyslogd: the last error occured in
/etc/rsyslog.conf, line 128:"if $!uid == '1000' then /var/log/nobody.log"
Aug 28 10:49:34 test rsyslogd: warning: selector line without actions
will be discarded
Aug 28 10:49:34 test rsyslogd-2124: CONFIG ERROR: could not interpret
master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
$ModLoad imuxsock.so # provides support for local system logging
$ModLoad imklog # provides kernel logging support
$SystemLogSocketAnnotate on
$SystemLogParseTrusted on
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
if $!uid == '1000' then /var/log/nobody.log
Why rsyslog cant find the config file commands. It works with rsyslog 8.
I use a debian 7 wheezy. Which modules I forgot to load? How can I do
these filter with rsyslog 5.8.11 under debian 7? This feature should be
available
http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html
Thanks you so much