Mailing List Archive: RSyslog: users

upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2

Index | Next | Previous | View Threaded

larasanz16 at hotmail

Apr 12, 2012, 12:50 AM

Post #1 of 6 (309 views)
Permalink

upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2

Hi to all!!Hi have a problem.I'm upgrade rsyslog 3.22.1 to rsyslog 4.8.0 in CENTOS 5.2, but my rsyslog not loggin.I'm using this How to, http://www.howtoforge.com/installing-fu ... centos-5.x, but don't intall all features, I just made a normal compilation, ./configuremakemake installmy /var/log/messages shows the following messageshas not logged anything for two hours, this is the last message that appearskernel: imklog 3.22.1, log source = /proc/kmsg started.2012-04-04T10:24:25.749184+02:00 rsyslogd: [origin software="rsyslogd" swVersion="3.22.1" x-pid="31688" x-info="http://www.rsyslog.com"] (re)start2012-04-04T10:24:25.747635+02:00 rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c3 as the first rsyslogd option.2012-04-04T10:24:25.748787+02:00 rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsockI'm configure /etc/init.d/rsyslog and add this line:# Source configif [ -f /etc/sysconfig/$prog ] ; then. /etc/sysconfig/$progelseSYSLOGD_OPTIONS="-c3"fiI also change this file /etc/sysconfig/rsyslogand addSYSLOGD_OPTIONS="-c3 -f /etc/rsyslog.conf"My rsyslog.conf using templates.but I have not created any of the folders listed in the templates.This is my rsyslog.conf# if you experience problems, check# http://www.rsyslog.com/troubleshoot for assistance# rsyslog v3: load input modules# If you do not load inputs, nothing happens!# You may need to set the module load path if modules are not found.$ModLoad immark # provides --MARK-- message capability$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imklog # kernel logging (formerly provided by rklogd)$template DynMsg, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/messages.log"$template DynSecure, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/secure.log"$template DynKern, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/console.log"$template DynMail, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/mail.log"$template DynCron, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/cron.log"$template DynSpooler, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/spooler.log"# Log all kernel messages to the console.# Logging much else clutters up the screen.kern.* ?DynKern # /dev/console# Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none ?DynMsg # -/var/log/messages# The authpriv file has restricted access.authpriv.* ?DynSecure # /var/log/secure# Log all the mail messages in one place.mail.* ?DynMail # -/var/log/maillog# Log cron stuffcron.* ?DynCron # -/var/log/cron# Everybody gets emergency messages*.emerg *# Save news errors of level crit and higher in a special file.uucp,news.crit ?DynSpooler # -/var/log/spooler# Save boot messages also to boot.loglocal7.* /var/log/boot.log# Remote Logging (we use TCP for reliable delivery)# An on-disk queue is created for this action. If the remote host is# down, messages are spooled to disk and sent when it is up again.$ActionForwardDefaultTemplate RSYSLOG_ForwardFormart#$WorkDirectory /rsyslog/spool # where to place spool files#$ActionQueueFileName uniqName # unique name prefix for spool files#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown#$ActionQueueType LinkedList # run asynchronously#$ActionResumeRetryCount -1 # infinite retries if host is down# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional#*.* @@IP:514
i'm launch command:ps aux | grep rsyslogroot 32448 0.0 0.0 131648 1168 ? Sl 16:46 0:00 /sbin/rsyslogd -i /var/run/rsyslogd.pid -c3 -f /etc/rsyslog.conf
Thanks for your help and sorry for my english
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

radu0gheorghe at gmail

Apr 12, 2012, 8:15 AM

Post #2 of 6 (242 views)
Permalink

Re: upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2 [In reply to]

2012/4/12 Lara S. <larasanz16 [at] hotmail>:
>
> Hi to all!!Hi have a problem.I'm upgrade rsyslog 3.22.1 to rsyslog 4.8.0 in CENTOS 5.2, but my rsyslog not loggin.I'm using this How to, http://www.howtoforge.com/installing-fu ... centos-5.x, but don't intall all features, I just made a normal compilation, ./configuremakemake installmy /var/log/messages shows the following messageshas not logged anything for two hours, this is the last message that appearskernel: imklog 3.22.1, log source = /proc/kmsg started.2012-04-04T10:24:25.749184+02:00 rsyslogd: [origin software="rsyslogd" swVersion="3.22.1" x-pid="31688" x-info="http://www.rsyslog.com"] (re)start2012-04-04T10:24:25.747635+02:00 rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c3 as the first rsyslogd option.2012-04-04T10:24:25.748787+02:00 rsyslogd: Warning: backward compatibility layer added to following directive to rsys
log.conf: ModLoad imuxsockI'm configure /etc/init.d/rsyslog and add this line:# Source configif [ -f /etc/sysconfig/$prog ] ; then. /etc/sysconfig/$progelseSYSLOGD_OPTIONS="-c3"fiI also change this file /etc/sysconfig/rsyslogand addSYSLOGD_OPTIONS="-c3 -f /etc/rsyslog.conf"My rsyslog.conf using templates.but I have not created any of the folders listed in the templates.This is my rsyslog.conf# if you experience problems, check# http://www.rsyslog.com/troubleshoot for assistance# rsyslog v3: load input modules# If you do not load inputs, nothing happens!# You may need to set the module load path if modules are not found.$ModLoad immark # provides --MARK-- message capability$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imklog # kernel logging (formerly provided by rklogd)$template DynMsg, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/messages.log"$template DynSecure, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/secure.log"$template DynKern, "
/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/console.log"$template DynMail, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/mail.log"$template DynCron, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/cron.log"$template DynSpooler, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/spooler.log"# Log all kernel messages to the console.# Logging much else clutters up the screen.kern.* ?DynKern # /dev/console# Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none ?DynMsg # -/var/log/messages# The authpriv file has restricted access.authpriv.* ?DynSecure # /var/log/secure# Log all the mail messages in one place.mail.* ?DynMail # -/var/log/maillog# Log cron stuffcron.* ?DynCron # -/var/log/cron# Everybody gets emergency messages*.emerg *# Save news errors of level crit and higher in a special file.uucp,news.crit ?DynSpooler # -/var/log/spooler# Save boot messages also to boot.loglocal7.* /var/log/boot.log# Remote Logging (we use TCP for rel
iable delivery)# An on-disk queue is created for this action. If the remote host is# down, messages are spooled to disk and sent when it is up again.$ActionForwardDefaultTemplate RSYSLOG_ForwardFormart#$WorkDirectory /rsyslog/spool # where to place spool files#$ActionQueueFileName uniqName # unique name prefix for spool files#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown#$ActionQueueType LinkedList # run asynchronously#$ActionResumeRetryCount -1 # infinite retries if host is down# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional#*.* @@IP:514
> i'm launch command:ps aux | grep rsyslogroot 32448 0.0 0.0 131648 1168 ? Sl 16:46 0:00 /sbin/rsyslogd -i /var/run/rsyslogd.pid -c3 -f /etc/rsyslog.conf
> Thanks for your help and sorry for my english

Hi Lara,

Your mail came all in one line for me. Can you please format it and
send it again? I've tried to understand the problem as it is, but I
couldn't :(

Best regards,
Radu
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

lara.sanz.15 at gmail

Apr 17, 2012, 2:09 AM

Post #3 of 6 (232 views)
Permalink

upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2 [In reply to]

Hi to all!!

Hi have a problem.

I'm upgrade rsyslog 3.22.1 to rsyslog 4.8.0 in CENTOS 5.2, but my rsyslog
not loggin.

I'm using this How to, http://www.howtoforge.com/installing-fu ...
centos-5.x, but don't intall all features, I just made a normal
compilation,

./configure
make
make install

my /var/log/messages shows the following messages
has not logged anything for two hours, this is the last message that appears

kernel: imklog 3.22.1, log source = /proc/kmsg started.
2012-04-04T10:24:25.749184+02:00 rsyslogd: [origin software="rsyslogd"
swVersion="3.22.1" x-pid="31688" x-info="http://www.rsyslog.com"] (re)start
2012-04-04T10:24:25.747635+02:00 rsyslogd: WARNING: rsyslogd is running in
compatibility mode. Automatically generated config directives may interfer
with your rsyslog.conf settings. We suggest upgrading your config and
adding -c3 as the first rsyslogd option.
2012-04-04T10:24:25.748787+02:00 rsyslogd: Warning: backward compatibility
layer added to following directive to rsyslog.conf: ModLoad imuxsock

I'm configure /etc/init.d/rsyslog and add this line:
# Source config
if [ -f /etc/sysconfig/$prog ] ; then
. /etc/sysconfig/$prog
else
SYSLOGD_OPTIONS="-c3"
fi

I also change this file /etc/sysconfig/rsyslog
and add

SYSLOGD_OPTIONS="-c3 -f /etc/rsyslog.conf"

My rsyslog.conf using templates.
but I have not created any of the folders listed in the templates.
This is my rsyslog.conf

# if you experience problems, check
# http://www.rsyslog.com/troubleshoot for assistance

# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
# You may need to set the module load path if modules are not found.

$ModLoad immark # provides --MARK-- message capability
$ModLoad imuxsock # provides support for local system logging (e.g. via
logger command)
$ModLoad imklog # kernel logging (formerly provided by rklogd)

$template DynMsg, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/messages.log"
$template DynSecure, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/secure.log"
$template DynKern, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/console.log"
$template DynMail, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/mail.log"
$template DynCron, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/cron.log"
$template DynSpooler, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/spooler.log"

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.* ?DynKern # /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none ?DynMsg # -/var/log/messages

# The authpriv file has restricted access.
authpriv.* ?DynSecure # /var/log/secure

# Log all the mail messages in one place.
mail.* ?DynMail # -/var/log/maillog

# Log cron stuff
cron.* ?DynCron # -/var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit ?DynSpooler # -/var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log

# Remote Logging (we use TCP for reliable delivery)
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.

$ActionForwardDefaultTemplate RSYSLOG_ForwardFormart

#$WorkDirectory /rsyslog/spool # where to place spool files
#$ActionQueueFileName uniqName # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@IP:514

I'm launch command:

ps aux | grep rsyslog

root 32448 0.0 0.0 131648 1168 ? Sl 16:46 0:00 /sbin/rsyslogd -i
/var/run/rsyslogd.pid -c3 -f /etc/rsyslog.conf

Thanks for your help and sorry for my english
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

rgerhards at hq

Apr 17, 2012, 10:57 PM

Post #4 of 6 (238 views)
Permalink

Re: upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2 [In reply to]

I don't see anything that's obviously wrong. Did SELinux get into your way?
Maybe you should disable it and check if that changes anything...

Rainer

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of lara sanz sanchis
> Sent: Tuesday, April 17, 2012 11:09 AM
> To: rsyslog [at] lists
> Subject: [rsyslog] upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2
>
> Hi to all!!
>
> Hi have a problem.
>
> I'm upgrade rsyslog 3.22.1 to rsyslog 4.8.0 in CENTOS 5.2, but my
> rsyslog
> not loggin.
>
> I'm using this How to, http://www.howtoforge.com/installing-fu ...
> centos-5.x, but don't intall all features, I just made a normal
> compilation,
>
> ./configure
> make
> make install
>
> my /var/log/messages shows the following messages
> has not logged anything for two hours, this is the last message that
> appears
>
> kernel: imklog 3.22.1, log source = /proc/kmsg started.
> 2012-04-04T10:24:25.749184+02:00 rsyslogd: [origin software="rsyslogd"
> swVersion="3.22.1" x-pid="31688" x-info="http://www.rsyslog.com"]
> (re)start
> 2012-04-04T10:24:25.747635+02:00 rsyslogd: WARNING: rsyslogd is running
> in
> compatibility mode. Automatically generated config directives may
> interfer
> with your rsyslog.conf settings. We suggest upgrading your config and
> adding -c3 as the first rsyslogd option.
> 2012-04-04T10:24:25.748787+02:00 rsyslogd: Warning: backward
> compatibility
> layer added to following directive to rsyslog.conf: ModLoad imuxsock
>
> I'm configure /etc/init.d/rsyslog and add this line:
> # Source config
> if [ -f /etc/sysconfig/$prog ] ; then
> . /etc/sysconfig/$prog
> else
> SYSLOGD_OPTIONS="-c3"
> fi
>
>
> I also change this file /etc/sysconfig/rsyslog
> and add
>
> SYSLOGD_OPTIONS="-c3 -f /etc/rsyslog.conf"
>
> My rsyslog.conf using templates.
> but I have not created any of the folders listed in the templates.
> This is my rsyslog.conf
>
>
> # if you experience problems, check
> # http://www.rsyslog.com/troubleshoot for assistance
>
> # rsyslog v3: load input modules
> # If you do not load inputs, nothing happens!
> # You may need to set the module load path if modules are not found.
>
> $ModLoad immark # provides --MARK-- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g. via
> logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
>
> $template DynMsg, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/messages.log"
> $template DynSecure, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/secure.log"
> $template DynKern, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/console.log"
> $template DynMail, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/mail.log"
> $template DynCron, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/cron.log"
> $template DynSpooler,
> "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/spooler.log"
>
>
> # Log all kernel messages to the console.
> # Logging much else clutters up the screen.
> kern.* ?DynKern # /dev/console
>
> # Log anything (except mail) of level info or higher.
> # Don't log private authentication messages!
> *.info;mail.none;authpriv.none;cron.none ?DynMsg # -/var/log/messages
>
> # The authpriv file has restricted access.
> authpriv.* ?DynSecure # /var/log/secure
>
> # Log all the mail messages in one place.
> mail.* ?DynMail # -/var/log/maillog
>
>
> # Log cron stuff
> cron.* ?DynCron # -/var/log/cron
>
> # Everybody gets emergency messages
> *.emerg *
>
> # Save news errors of level crit and higher in a special file.
> uucp,news.crit ?DynSpooler # -/var/log/spooler
>
> # Save boot messages also to boot.log
> local7.* /var/log/boot.log
>
> # Remote Logging (we use TCP for reliable delivery)
> # An on-disk queue is created for this action. If the remote host is
> # down, messages are spooled to disk and sent when it is up again.
>
> $ActionForwardDefaultTemplate RSYSLOG_ForwardFormart
>
> #$WorkDirectory /rsyslog/spool # where to place spool files
> #$ActionQueueFileName uniqName # unique name prefix for spool files
> #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as
> possible)
> #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
> #$ActionQueueType LinkedList # run asynchronously
> #$ActionResumeRetryCount -1 # infinite retries if host is down
> # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
> #*.* @@IP:514
>
>
> I'm launch command:
>
> ps aux | grep rsyslog
>
> root 32448 0.0 0.0 131648 1168 ? Sl 16:46 0:00 /sbin/rsyslogd -i
> /var/run/rsyslogd.pid -c3 -f /etc/rsyslog.conf
>
> Thanks for your help and sorry for my english
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

lara.sanz.15 at gmail

Apr 25, 2012, 7:10 AM

Post #5 of 6 (215 views)
Permalink

Re: upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2 [In reply to]

Hi,

in my server logs I enabled SELinux puero and 11514 for the service up
properly.
My client has SElinux disabled and I can not send to my server logs, no
stores inlocalhost, I have also disabled iptables on both machines.

I think it may be a compatibility problem, the customer service up as -c3
compatibility, should be c4 ?

thanks for your help

2012/4/17 lara sanz sanchis <lara.sanz.15 [at] gmail>

> Hi to all!!
>
> Hi have a problem.
>
> I'm upgrade rsyslog 3.22.1 to rsyslog 4.8.0 in CENTOS 5.2, but my rsyslog
> not loggin.
>
> I'm using this How to, http://www.howtoforge.com/installing-fu ...
> centos-5.x, but don't intall all features, I just made a normal
> compilation,
>
> ./configure
> make
> make install
>
> my /var/log/messages shows the following messages
> has not logged anything for two hours, this is the last message that
> appears
>
> kernel: imklog 3.22.1, log source = /proc/kmsg started.
> 2012-04-04T10:24:25.749184+02:00 rsyslogd: [origin software="rsyslogd"
> swVersion="3.22.1" x-pid="31688" x-info="http://www.rsyslog.com"]
> (re)start
> 2012-04-04T10:24:25.747635+02:00 rsyslogd: WARNING: rsyslogd is running in
> compatibility mode. Automatically generated config directives may interfer
> with your rsyslog.conf settings. We suggest upgrading your config and
> adding -c3 as the first rsyslogd option.
> 2012-04-04T10:24:25.748787+02:00 rsyslogd: Warning: backward compatibility
> layer added to following directive to rsyslog.conf: ModLoad imuxsock
>
> I'm configure /etc/init.d/rsyslog and add this line:
> # Source config
> if [ -f /etc/sysconfig/$prog ] ; then
> . /etc/sysconfig/$prog
> else
> SYSLOGD_OPTIONS="-c3"
> fi
>
>
> I also change this file /etc/sysconfig/rsyslog
> and add
>
> SYSLOGD_OPTIONS="-c3 -f /etc/rsyslog.conf"
>
> My rsyslog.conf using templates.
> but I have not created any of the folders listed in the templates.
> This is my rsyslog.conf
>
>
> # if you experience problems, check
> # http://www.rsyslog.com/troubleshoot for assistance
>
> # rsyslog v3: load input modules
> # If you do not load inputs, nothing happens!
> # You may need to set the module load path if modules are not found.
>
> $ModLoad immark # provides --MARK-- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g. via
> logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
>
> $template DynMsg, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/messages.log"
> $template DynSecure, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/secure.log"
> $template DynKern, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/console.log"
> $template DynMail, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/mail.log"
> $template DynCron, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/cron.log"
> $template DynSpooler, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/spooler.log"
>
>
> # Log all kernel messages to the console.
> # Logging much else clutters up the screen.
> kern.* ?DynKern # /dev/console
>
> # Log anything (except mail) of level info or higher.
> # Don't log private authentication messages!
> *.info;mail.none;authpriv.none;cron.none ?DynMsg # -/var/log/messages
>
> # The authpriv file has restricted access.
> authpriv.* ?DynSecure # /var/log/secure
>
> # Log all the mail messages in one place.
> mail.* ?DynMail # -/var/log/maillog
>
>
> # Log cron stuff
> cron.* ?DynCron # -/var/log/cron
>
> # Everybody gets emergency messages
> *.emerg *
>
> # Save news errors of level crit and higher in a special file.
> uucp,news.crit ?DynSpooler # -/var/log/spooler
>
> # Save boot messages also to boot.log
> local7.* /var/log/boot.log
>
> # Remote Logging (we use TCP for reliable delivery)
> # An on-disk queue is created for this action. If the remote host is
> # down, messages are spooled to disk and sent when it is up again.
>
> $ActionForwardDefaultTemplate RSYSLOG_ForwardFormart
>
> #$WorkDirectory /rsyslog/spool # where to place spool files
> #$ActionQueueFileName uniqName # unique name prefix for spool files
> #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
> #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
> #$ActionQueueType LinkedList # run asynchronously
> #$ActionResumeRetryCount -1 # infinite retries if host is down
> # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
> #*.* @@IP:514
>
>
> I'm launch command:
>
> ps aux | grep rsyslog
>
> root 32448 0.0 0.0 131648 1168 ? Sl 16:46 0:00 /sbin/rsyslogd -i
> /var/run/rsyslogd.pid -c3 -f /etc/rsyslog.conf
>
> Thanks for your help and sorry for my english
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

david at lang

Apr 25, 2012, 8:11 AM

Post #6 of 6 (211 views)
Permalink

Re: upgrade rsyslog 3.22.1 to rsyslog 4.8.0 CENTOS 5.2 [In reply to]

On Wed, 25 Apr 2012, lara sanz sanchis wrote:

> Hi,
>
>
> in my server logs I enabled SELinux puero and 11514 for the service up
> properly.
> My client has SElinux disabled and I can not send to my server logs, no
> stores inlocalhost, I have also disabled iptables on both machines.
>
> I think it may be a compatibility problem, the customer service up as -c3
> compatibility, should be c4 ?

yes, with version 4 you should use c4

by the way, since you are upgrading, be aware that rsyslog 4.x is past end
of life, you should upgrade to 5.x or 6.x

David Lang

> thanks for your help
>
> 2012/4/17 lara sanz sanchis <lara.sanz.15 [at] gmail>
>
>> Hi to all!!
>>
>> Hi have a problem.
>>
>> I'm upgrade rsyslog 3.22.1 to rsyslog 4.8.0 in CENTOS 5.2, but my rsyslog
>> not loggin.
>>
>> I'm using this How to, http://www.howtoforge.com/installing-fu ...
>> centos-5.x, but don't intall all features, I just made ??a normal
>> compilation,
>>
>> ./configure
>> make
>> make install
>>
>> my /var/log/messages shows the following messages
>> has not logged anything for two hours, this is the last message that
>> appears
>>
>> kernel: imklog 3.22.1, log source = /proc/kmsg started.
>> 2012-04-04T10:24:25.749184+02:00 rsyslogd: [origin software="rsyslogd"
>> swVersion="3.22.1" x-pid="31688" x-info="http://www.rsyslog.com"]
>> (re)start
>> 2012-04-04T10:24:25.747635+02:00 rsyslogd: WARNING: rsyslogd is running in
>> compatibility mode. Automatically generated config directives may interfer
>> with your rsyslog.conf settings. We suggest upgrading your config and
>> adding -c3 as the first rsyslogd option.
>> 2012-04-04T10:24:25.748787+02:00 rsyslogd: Warning: backward compatibility
>> layer added to following directive to rsyslog.conf: ModLoad imuxsock
>>
>> I'm configure /etc/init.d/rsyslog and add this line:
>> # Source config
>> if [ -f /etc/sysconfig/$prog ] ; then
>> . /etc/sysconfig/$prog
>> else
>> SYSLOGD_OPTIONS="-c3"
>> fi
>>
>>
>> I also change this file /etc/sysconfig/rsyslog
>> and add
>>
>> SYSLOGD_OPTIONS="-c3 -f /etc/rsyslog.conf"
>>
>> My rsyslog.conf using templates.
>> but I have not created any of the folders listed in the templates.
>> This is my rsyslog.conf
>>
>>
>> # if you experience problems, check
>> # http://www.rsyslog.com/troubleshoot for assistance
>>
>> # rsyslog v3: load input modules
>> # If you do not load inputs, nothing happens!
>> # You may need to set the module load path if modules are not found.
>>
>> $ModLoad immark # provides --MARK-- message capability
>> $ModLoad imuxsock # provides support for local system logging (e.g. via
>> logger command)
>> $ModLoad imklog # kernel logging (formerly provided by rklogd)
>>
>> $template DynMsg, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/messages.log"
>> $template DynSecure, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/secure.log"
>> $template DynKern, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/console.log"
>> $template DynMail, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/mail.log"
>> $template DynCron, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/cron.log"
>> $template DynSpooler, "/var/log/%HOSTNAME%/%$YEAR%/%$MONTH%/spooler.log"
>>
>>
>> # Log all kernel messages to the console.
>> # Logging much else clutters up the screen.
>> kern.* ?DynKern # /dev/console
>>
>> # Log anything (except mail) of level info or higher.
>> # Don't log private authentication messages!
>> *.info;mail.none;authpriv.none;cron.none ?DynMsg # -/var/log/messages
>>
>> # The authpriv file has restricted access.
>> authpriv.* ?DynSecure # /var/log/secure
>>
>> # Log all the mail messages in one place.
>> mail.* ?DynMail # -/var/log/maillog
>>
>>
>> # Log cron stuff
>> cron.* ?DynCron # -/var/log/cron
>>
>> # Everybody gets emergency messages
>> *.emerg *
>>
>> # Save news errors of level crit and higher in a special file.
>> uucp,news.crit ?DynSpooler # -/var/log/spooler
>>
>> # Save boot messages also to boot.log
>> local7.* /var/log/boot.log
>>
>> # Remote Logging (we use TCP for reliable delivery)
>> # An on-disk queue is created for this action. If the remote host is
>> # down, messages are spooled to disk and sent when it is up again.
>>
>> $ActionForwardDefaultTemplate RSYSLOG_ForwardFormart
>>
>> #$WorkDirectory /rsyslog/spool # where to place spool files
>> #$ActionQueueFileName uniqName # unique name prefix for spool files
>> #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
>> #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
>> #$ActionQueueType LinkedList # run asynchronously
>> #$ActionResumeRetryCount -1 # infinite retries if host is down
>> # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
>> #*.* @@IP:514
>>
>>
>> I'm launch command:
>>
>> ps aux | grep rsyslog
>>
>> root 32448 0.0 0.0 131648 1168 ? Sl 16:46 0:00 /sbin/rsyslogd -i
>> /var/run/rsyslogd.pid -c3 -f /etc/rsyslog.conf
>>
>> Thanks for your help and sorry for my english
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads