Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: RSyslog: users

error on app-name contains

 

 

RSyslog users RSS feed   Index | Next | Previous | View Threaded


swillis at compete

Apr 25, 2012, 5:02 PM

Post #1 of 11 (830 views)
Permalink
error on app-name contains

Hi,

I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:

:app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat

The error line in /var/log/messages is:

Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"

I don't get that error with 5.8.1 on ubuntu. I looked through the documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm doing it right, can you help me out?

-Steven Willis
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


david at lang

Apr 25, 2012, 5:29 PM

Post #2 of 11 (790 views)
Permalink
Re: error on app-name contains [In reply to]

the first thing that I always look at is should you use " or ' rsyslog 4.x
only accepts one, and I _think_ I remember it's '

David Lang

On Wed, 25 Apr 2012, Steven Willis wrote:

> Hi,
>
> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>
> :app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>
> The error line in /var/log/messages is:
>
> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>
> I don't get that error with 5.8.1 on ubuntu. I looked through the documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm doing it right, can you help me out?
>
> -Steven Willis
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


swillis at compete

Apr 26, 2012, 7:43 AM

Post #3 of 11 (794 views)
Permalink
Re: error on app-name contains [In reply to]

Well, I tried changing it to single quotes and that completely broke rsyslog. It would crash on startup, no error messages or anything. I also tried no quotes, but that failed just like single quotes. I also tried adding spaces after the commas, but that made no difference. I noticed that in the default redhat config all the modules had .so after them, whereas my ubuntu config didn't. It seemed like I could do it either way on the $ModLoad line, but perhaps I need to do :omrelp.so: when using it?

-Steve
________________________________________
From: rsyslog-bounces [at] lists [rsyslog-bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
Sent: Wednesday, April 25, 2012 8:29 PM
To: rsyslog-users
Subject: Re: [rsyslog] error on app-name contains

the first thing that I always look at is should you use " or ' rsyslog 4.x
only accepts one, and I _think_ I remember it's '

David Lang

On Wed, 25 Apr 2012, Steven Willis wrote:

> Hi,
>
> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>
> :app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>
> The error line in /var/log/messages is:
>
> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>
> I don't get that error with 5.8.1 on ubuntu. I looked through the documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm doing it right, can you help me out?
>
> -Steven Willis
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


david at lang

Apr 26, 2012, 9:09 AM

Post #4 of 11 (785 views)
Permalink
Re: error on app-name contains [In reply to]

The other thing is that it may be that app-name doesn't exist in such an
old version.

Why are you using app-name instead of programname?

David Lang

On Thu, 26 Apr 2012, Steven Willis wrote:

> Date: Thu, 26 Apr 2012 10:43:23 -0400
> From: Steven Willis <swillis [at] compete>
> Reply-To: rsyslog-users <rsyslog [at] lists>
> To: rsyslog-users <rsyslog [at] lists>
> Subject: Re: [rsyslog] error on app-name contains
>
> Well, I tried changing it to single quotes and that completely broke rsyslog. It would crash on startup, no error messages or anything. I also tried no quotes, but that failed just like single quotes. I also tried adding spaces after the commas, but that made no difference. I noticed that in the default redhat config all the modules had .so after them, whereas my ubuntu config didn't. It seemed like I could do it either way on the $ModLoad line, but perhaps I need to do :omrelp.so: when using it?
>
> -Steve
> ________________________________________
> From: rsyslog-bounces [at] lists [rsyslog-bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
> Sent: Wednesday, April 25, 2012 8:29 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] error on app-name contains
>
> the first thing that I always look at is should you use " or ' rsyslog 4.x
> only accepts one, and I _think_ I remember it's '
>
> David Lang
>
> On Wed, 25 Apr 2012, Steven Willis wrote:
>
>> Hi,
>>
>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>>
>> :app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>>
>> The error line in /var/log/messages is:
>>
>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>
>> I don't get that error with 5.8.1 on ubuntu. I looked through the documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm doing it right, can you help me out?
>>
>> -Steven Willis
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


swillis at compete

Apr 26, 2012, 9:39 AM

Post #5 of 11 (789 views)
Permalink
Re: error on app-name contains [In reply to]

There was no particular reason to use app-name rather than programname, but I still get the error when using programname:

Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in /etc/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"

-Steven Willis
________________________________________
From: rsyslog-bounces [at] lists [rsyslog-bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
Sent: Thursday, April 26, 2012 12:09 PM
To: rsyslog-users
Subject: Re: [rsyslog] error on app-name contains

The other thing is that it may be that app-name doesn't exist in such an
old version.

Why are you using app-name instead of programname?

David Lang

On Thu, 26 Apr 2012, Steven Willis wrote:

> Date: Thu, 26 Apr 2012 10:43:23 -0400
> From: Steven Willis <swillis [at] compete>
> Reply-To: rsyslog-users <rsyslog [at] lists>
> To: rsyslog-users <rsyslog [at] lists>
> Subject: Re: [rsyslog] error on app-name contains
>
> Well, I tried changing it to single quotes and that completely broke rsyslog. It would crash on startup, no error messages or anything. I also tried no quotes, but that failed just like single quotes. I also tried adding spaces after the commas, but that made no difference. I noticed that in the default redhat config all the modules had .so after them, whereas my ubuntu config didn't. It seemed like I could do it either way on the $ModLoad line, but perhaps I need to do :omrelp.so: when using it?
>
> -Steve
> ________________________________________
> From: rsyslog-bounces [at] lists [rsyslog-bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
> Sent: Wednesday, April 25, 2012 8:29 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] error on app-name contains
>
> the first thing that I always look at is should you use " or ' rsyslog 4.x
> only accepts one, and I _think_ I remember it's '
>
> David Lang
>
> On Wed, 25 Apr 2012, Steven Willis wrote:
>
>> Hi,
>>
>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>>
>> :app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>>
>> The error line in /var/log/messages is:
>>
>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>
>> I don't get that error with 5.8.1 on ubuntu. I looked through the documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm doing it right, can you help me out?
>>
>> -Steven Willis
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


swillis at compete

Apr 26, 2012, 2:56 PM

Post #6 of 11 (805 views)
Permalink
Re: error on app-name contains [In reply to]

Here's the same run with -d

7309.623707350:7ff800f7c700: requested to include config file '/etc/rsyslog-test/rsyslog.d/10-datanode.conf'
7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat'
7309.623786771:7ff800f7c700: - property-based filter
7309.623813276:7ff800f7c700: tried selector action for builtin-file: -2001
7309.623831837:7ff800f7c700: tried selector action for builtin-pipe: -2001
7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001
7309.623865515:7ff800f7c700: tried selector action for builtin-shell: -2001
7309.623882173:7ff800f7c700: tried selector action for builtin-discard: -2001
7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg: -2001
7309.623914751:7ff800f7c700: config line NOT successfully processed
7309.623934707:7ff800f7c700: Called LogError, msg: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
rsyslogd: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Steven Willis
> Sent: Thursday, April 26, 2012 12:39 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] error on app-name contains
>
> There was no particular reason to use app-name rather than programname,
> but I still get the error when using programname:
>
> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in
> /etc/rsyslog.d/10-datanode.conf, line
> 1:":programname,isequal,"DataNode"
> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>
> -Steven Willis
> ________________________________________
> From: rsyslog-bounces [at] lists [rsyslog-
> bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
> Sent: Thursday, April 26, 2012 12:09 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] error on app-name contains
>
> The other thing is that it may be that app-name doesn't exist in such
> an old version.
>
> Why are you using app-name instead of programname?
>
> David Lang
>
> On Thu, 26 Apr 2012, Steven Willis wrote:
>
> > Date: Thu, 26 Apr 2012 10:43:23 -0400
> > From: Steven Willis <swillis [at] compete>
> > Reply-To: rsyslog-users <rsyslog [at] lists>
> > To: rsyslog-users <rsyslog [at] lists>
> > Subject: Re: [rsyslog] error on app-name contains
> >
> > Well, I tried changing it to single quotes and that completely broke
> rsyslog. It would crash on startup, no error messages or anything. I
> also tried no quotes, but that failed just like single quotes. I also
> tried adding spaces after the commas, but that made no difference. I
> noticed that in the default redhat config all the modules had .so after
> them, whereas my ubuntu config didn't. It seemed like I could do it
> either way on the $ModLoad line, but perhaps I need to do :omrelp.so:
> when using it?
> >
> > -Steve
> > ________________________________________
> > From: rsyslog-bounces [at] lists
> > [rsyslog-bounces [at] lists] On Behalf Of david [at] lang
> > [david [at] lang]
> > Sent: Wednesday, April 25, 2012 8:29 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] error on app-name contains
> >
> > the first thing that I always look at is should you use " or '
> rsyslog
> > 4.x only accepts one, and I _think_ I remember it's '
> >
> > David Lang
> >
> > On Wed, 25 Apr 2012, Steven Willis wrote:
> >
> >> Hi,
> >>
> >> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
> >>
> >> :app-name,contains,"DataNode"
> >> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
> >>
> >> The error line in /var/log/messages is:
> >>
> >> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in
> /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode"
> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
> >>
> >> I don't get that error with 5.8.1 on ubuntu. I looked through the
> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm
> doing it right, can you help me out?
> >>
> >> -Steven Willis
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


david at lang

Apr 26, 2012, 4:39 PM

Post #7 of 11 (792 views)
Permalink
Re: error on app-name contains [In reply to]

As I read this, it's failing in trying to figure out the action. Please
try the same condition, but just writing to a file instead of to relp.
that will tell us if it's the condition that's the problem or the
destination.

It's looking like relp may not be enabled on your build.

David Lang

On Thu, 26 Apr 2012, Steven Willis wrote:

> Here's the same run with -d
>
> 7309.623707350:7ff800f7c700: requested to include config file '/etc/rsyslog-test/rsyslog.d/10-datanode.conf'
> 7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat'
> 7309.623786771:7ff800f7c700: - property-based filter
> 7309.623813276:7ff800f7c700: tried selector action for builtin-file: -2001
> 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe: -2001
> 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001
> 7309.623865515:7ff800f7c700: tried selector action for builtin-shell: -2001
> 7309.623882173:7ff800f7c700: tried selector action for builtin-discard: -2001
> 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg: -2001
> 7309.623914751:7ff800f7c700: config line NOT successfully processed
> 7309.623934707:7ff800f7c700: Called LogError, msg: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
> rsyslogd: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>
>> -----Original Message-----
>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> bounces [at] lists] On Behalf Of Steven Willis
>> Sent: Thursday, April 26, 2012 12:39 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] error on app-name contains
>>
>> There was no particular reason to use app-name rather than programname,
>> but I still get the error when using programname:
>>
>> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in
>> /etc/rsyslog.d/10-datanode.conf, line
>> 1:":programname,isequal,"DataNode"
>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>
>> -Steven Willis
>> ________________________________________
>> From: rsyslog-bounces [at] lists [rsyslog-
>> bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
>> Sent: Thursday, April 26, 2012 12:09 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] error on app-name contains
>>
>> The other thing is that it may be that app-name doesn't exist in such
>> an old version.
>>
>> Why are you using app-name instead of programname?
>>
>> David Lang
>>
>> On Thu, 26 Apr 2012, Steven Willis wrote:
>>
>>> Date: Thu, 26 Apr 2012 10:43:23 -0400
>>> From: Steven Willis <swillis [at] compete>
>>> Reply-To: rsyslog-users <rsyslog [at] lists>
>>> To: rsyslog-users <rsyslog [at] lists>
>>> Subject: Re: [rsyslog] error on app-name contains
>>>
>>> Well, I tried changing it to single quotes and that completely broke
>> rsyslog. It would crash on startup, no error messages or anything. I
>> also tried no quotes, but that failed just like single quotes. I also
>> tried adding spaces after the commas, but that made no difference. I
>> noticed that in the default redhat config all the modules had .so after
>> them, whereas my ubuntu config didn't. It seemed like I could do it
>> either way on the $ModLoad line, but perhaps I need to do :omrelp.so:
>> when using it?
>>>
>>> -Steve
>>> ________________________________________
>>> From: rsyslog-bounces [at] lists
>>> [rsyslog-bounces [at] lists] On Behalf Of david [at] lang
>>> [david [at] lang]
>>> Sent: Wednesday, April 25, 2012 8:29 PM
>>> To: rsyslog-users
>>> Subject: Re: [rsyslog] error on app-name contains
>>>
>>> the first thing that I always look at is should you use " or '
>> rsyslog
>>> 4.x only accepts one, and I _think_ I remember it's '
>>>
>>> David Lang
>>>
>>> On Wed, 25 Apr 2012, Steven Willis wrote:
>>>
>>>> Hi,
>>>>
>>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>>>>
>>>> :app-name,contains,"DataNode"
>>>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>>>>
>>>> The error line in /var/log/messages is:
>>>>
>>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in
>> /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode"
>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>>>
>>>> I don't get that error with 5.8.1 on ubuntu. I looked through the
>> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm
>> doing it right, can you help me out?
>>>>
>>>> -Steven Willis
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


swillis at compete

Apr 27, 2012, 7:06 AM

Post #8 of 11 (806 views)
Permalink
Re: error on app-name contains [In reply to]

Ah, I think I figured it out. I put the directive to load omrelp and the filter that used it into different files under /etc/rsyslog.d/. The file containing the load statement was being processes after the file containing the filter so omrelp wasn't yet available. I still don't know why the exact same setup worked on my other boxes. Are filters lazily evaluated in later versions of rsyslog?

-Steven Willis
________________________________________
From: rsyslog-bounces [at] lists [rsyslog-bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
Sent: Thursday, April 26, 2012 7:39 PM
To: rsyslog-users
Subject: Re: [rsyslog] error on app-name contains

As I read this, it's failing in trying to figure out the action. Please
try the same condition, but just writing to a file instead of to relp.
that will tell us if it's the condition that's the problem or the
destination.

It's looking like relp may not be enabled on your build.

David Lang

On Thu, 26 Apr 2012, Steven Willis wrote:

> Here's the same run with -d
>
> 7309.623707350:7ff800f7c700: requested to include config file '/etc/rsyslog-test/rsyslog.d/10-datanode.conf'
> 7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat'
> 7309.623786771:7ff800f7c700: - property-based filter
> 7309.623813276:7ff800f7c700: tried selector action for builtin-file: -2001
> 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe: -2001
> 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001
> 7309.623865515:7ff800f7c700: tried selector action for builtin-shell: -2001
> 7309.623882173:7ff800f7c700: tried selector action for builtin-discard: -2001
> 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg: -2001
> 7309.623914751:7ff800f7c700: config line NOT successfully processed
> 7309.623934707:7ff800f7c700: Called LogError, msg: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
> rsyslogd: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>
>> -----Original Message-----
>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> bounces [at] lists] On Behalf Of Steven Willis
>> Sent: Thursday, April 26, 2012 12:39 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] error on app-name contains
>>
>> There was no particular reason to use app-name rather than programname,
>> but I still get the error when using programname:
>>
>> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in
>> /etc/rsyslog.d/10-datanode.conf, line
>> 1:":programname,isequal,"DataNode"
>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>
>> -Steven Willis
>> ________________________________________
>> From: rsyslog-bounces [at] lists [rsyslog-
>> bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
>> Sent: Thursday, April 26, 2012 12:09 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] error on app-name contains
>>
>> The other thing is that it may be that app-name doesn't exist in such
>> an old version.
>>
>> Why are you using app-name instead of programname?
>>
>> David Lang
>>
>> On Thu, 26 Apr 2012, Steven Willis wrote:
>>
>>> Date: Thu, 26 Apr 2012 10:43:23 -0400
>>> From: Steven Willis <swillis [at] compete>
>>> Reply-To: rsyslog-users <rsyslog [at] lists>
>>> To: rsyslog-users <rsyslog [at] lists>
>>> Subject: Re: [rsyslog] error on app-name contains
>>>
>>> Well, I tried changing it to single quotes and that completely broke
>> rsyslog. It would crash on startup, no error messages or anything. I
>> also tried no quotes, but that failed just like single quotes. I also
>> tried adding spaces after the commas, but that made no difference. I
>> noticed that in the default redhat config all the modules had .so after
>> them, whereas my ubuntu config didn't. It seemed like I could do it
>> either way on the $ModLoad line, but perhaps I need to do :omrelp.so:
>> when using it?
>>>
>>> -Steve
>>> ________________________________________
>>> From: rsyslog-bounces [at] lists
>>> [rsyslog-bounces [at] lists] On Behalf Of david [at] lang
>>> [david [at] lang]
>>> Sent: Wednesday, April 25, 2012 8:29 PM
>>> To: rsyslog-users
>>> Subject: Re: [rsyslog] error on app-name contains
>>>
>>> the first thing that I always look at is should you use " or '
>> rsyslog
>>> 4.x only accepts one, and I _think_ I remember it's '
>>>
>>> David Lang
>>>
>>> On Wed, 25 Apr 2012, Steven Willis wrote:
>>>
>>>> Hi,
>>>>
>>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>>>>
>>>> :app-name,contains,"DataNode"
>>>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>>>>
>>>> The error line in /var/log/messages is:
>>>>
>>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in
>> /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode"
>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>>>
>>>> I don't get that error with 5.8.1 on ubuntu. I looked through the
>> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm
>> doing it right, can you help me out?
>>>>
>>>> -Steven Willis
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


david at lang

Apr 27, 2012, 9:17 AM

Post #9 of 11 (792 views)
Permalink
Re: error on app-name contains [In reply to]

On Fri, 27 Apr 2012, Steven Willis wrote:

> Ah, I think I figured it out. I put the directive to load omrelp and the
> filter that used it into different files under /etc/rsyslog.d/. The file
> containing the load statement was being processes after the file
> containing the filter so omrelp wasn't yet available. I still don't know
> why the exact same setup worked on my other boxes. Are filters lazily
> evaluated in later versions of rsyslog?

I don't believe that there is any lazy evaluation in the config files. I
believe that the files will get read in alpha order, but it's possible
that they could be read in inode order. In any case, I would not have
dependancies between different files in /etc/rsyslog.d, the odds of it
causing grief later are just too high.

David Lang

> -Steven Willis
> ________________________________________
> From: rsyslog-bounces [at] lists [rsyslog-bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
> Sent: Thursday, April 26, 2012 7:39 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] error on app-name contains
>
> As I read this, it's failing in trying to figure out the action. Please
> try the same condition, but just writing to a file instead of to relp.
> that will tell us if it's the condition that's the problem or the
> destination.
>
> It's looking like relp may not be enabled on your build.
>
> David Lang
>
> On Thu, 26 Apr 2012, Steven Willis wrote:
>
>> Here's the same run with -d
>>
>> 7309.623707350:7ff800f7c700: requested to include config file '/etc/rsyslog-test/rsyslog.d/10-datanode.conf'
>> 7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat'
>> 7309.623786771:7ff800f7c700: - property-based filter
>> 7309.623813276:7ff800f7c700: tried selector action for builtin-file: -2001
>> 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe: -2001
>> 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001
>> 7309.623865515:7ff800f7c700: tried selector action for builtin-shell: -2001
>> 7309.623882173:7ff800f7c700: tried selector action for builtin-discard: -2001
>> 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg: -2001
>> 7309.623914751:7ff800f7c700: config line NOT successfully processed
>> 7309.623934707:7ff800f7c700: Called LogError, msg: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>> rsyslogd: the last error occured in /etc/rsyslog-test/rsyslog.d/10-datanode.conf, line 1:":programname,isequal,"DataNode" :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>
>>> -----Original Message-----
>>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>> bounces [at] lists] On Behalf Of Steven Willis
>>> Sent: Thursday, April 26, 2012 12:39 PM
>>> To: rsyslog-users
>>> Subject: Re: [rsyslog] error on app-name contains
>>>
>>> There was no particular reason to use app-name rather than programname,
>>> but I still get the error when using programname:
>>>
>>> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in
>>> /etc/rsyslog.d/10-datanode.conf, line
>>> 1:":programname,isequal,"DataNode"
>>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>>
>>> -Steven Willis
>>> ________________________________________
>>> From: rsyslog-bounces [at] lists [rsyslog-
>>> bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
>>> Sent: Thursday, April 26, 2012 12:09 PM
>>> To: rsyslog-users
>>> Subject: Re: [rsyslog] error on app-name contains
>>>
>>> The other thing is that it may be that app-name doesn't exist in such
>>> an old version.
>>>
>>> Why are you using app-name instead of programname?
>>>
>>> David Lang
>>>
>>> On Thu, 26 Apr 2012, Steven Willis wrote:
>>>
>>>> Date: Thu, 26 Apr 2012 10:43:23 -0400
>>>> From: Steven Willis <swillis [at] compete>
>>>> Reply-To: rsyslog-users <rsyslog [at] lists>
>>>> To: rsyslog-users <rsyslog [at] lists>
>>>> Subject: Re: [rsyslog] error on app-name contains
>>>>
>>>> Well, I tried changing it to single quotes and that completely broke
>>> rsyslog. It would crash on startup, no error messages or anything. I
>>> also tried no quotes, but that failed just like single quotes. I also
>>> tried adding spaces after the commas, but that made no difference. I
>>> noticed that in the default redhat config all the modules had .so after
>>> them, whereas my ubuntu config didn't. It seemed like I could do it
>>> either way on the $ModLoad line, but perhaps I need to do :omrelp.so:
>>> when using it?
>>>>
>>>> -Steve
>>>> ________________________________________
>>>> From: rsyslog-bounces [at] lists
>>>> [rsyslog-bounces [at] lists] On Behalf Of david [at] lang
>>>> [david [at] lang]
>>>> Sent: Wednesday, April 25, 2012 8:29 PM
>>>> To: rsyslog-users
>>>> Subject: Re: [rsyslog] error on app-name contains
>>>>
>>>> the first thing that I always look at is should you use " or '
>>> rsyslog
>>>> 4.x only accepts one, and I _think_ I remember it's '
>>>>
>>>> David Lang
>>>>
>>>> On Wed, 25 Apr 2012, Steven Willis wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>>>>>
>>>>> :app-name,contains,"DataNode"
>>>>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat
>>>>>
>>>>> The error line in /var/log/messages is:
>>>>>
>>>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in
>>> /etc/rsyslog.d/10-datanode.conf, line 1:":app-name,contains,"DataNode"
>>> :omrelp:opbhdname001:20514;RSYSLOG_ForwardFormat"
>>>>>
>>>>> I don't get that error with 5.8.1 on ubuntu. I looked through the
>>> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm
>>> doing it right, can you help me out?
>>>>>
>>>>> -Steven Willis
>>>>> _______________________________________________
>>>>> rsyslog mailing list
>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>>> http://www.rsyslog.com/professional-services/
>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

Apr 30, 2012, 8:42 AM

Post #10 of 11 (781 views)
Permalink
Re: error on app-name contains [In reply to]

The files are read in inode order. At the last place I worked we
instituted a policy that all rsyslog conf files in the .d directory needed
to be completely self contained and not rely on any other part of the conf
because of this. It'll save you some headaches.

Brian

On Fri, Apr 27, 2012 at 12:17 PM, <david [at] lang> wrote:

> On Fri, 27 Apr 2012, Steven Willis wrote:
>
> Ah, I think I figured it out. I put the directive to load omrelp and the
>> filter that used it into different files under /etc/rsyslog.d/. The file
>> containing the load statement was being processes after the file containing
>> the filter so omrelp wasn't yet available. I still don't know why the exact
>> same setup worked on my other boxes. Are filters lazily evaluated in later
>> versions of rsyslog?
>>
>
> I don't believe that there is any lazy evaluation in the config files. I
> believe that the files will get read in alpha order, but it's possible that
> they could be read in inode order. In any case, I would not have
> dependancies between different files in /etc/rsyslog.d, the odds of it
> causing grief later are just too high.
>
> David Lang
>
>
> -Steven Willis
>> ______________________________**__________
>> From: rsyslog-bounces [at] lists**com<rsyslog-bounces [at] lists>[
>> rsyslog-bounces [at] lists**adiscon.com <rsyslog-bounces [at] lists>]
>> On Behalf Of david [at] lang [david [at] lang]
>> Sent: Thursday, April 26, 2012 7:39 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] error on app-name contains
>>
>> As I read this, it's failing in trying to figure out the action. Please
>> try the same condition, but just writing to a file instead of to relp.
>> that will tell us if it's the condition that's the problem or the
>> destination.
>>
>> It's looking like relp may not be enabled on your build.
>>
>> David Lang
>>
>> On Thu, 26 Apr 2012, Steven Willis wrote:
>>
>> Here's the same run with -d
>>>
>>> 7309.623707350:7ff800f7c700: requested to include config file
>>> '/etc/rsyslog-test/rsyslog.d/**10-datanode.conf'
>>> 7309.623765755:7ff800f7c700: cfline: ':programname,isequal,"**DataNode"
>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat'
>>> 7309.623786771:7ff800f7c700: - property-based filter
>>> 7309.623813276:7ff800f7c700: tried selector action for builtin-file:
>>> -2001
>>> 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe:
>>> -2001
>>> 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd: -2001
>>> 7309.623865515:7ff800f7c700: tried selector action for builtin-shell:
>>> -2001
>>> 7309.623882173:7ff800f7c700: tried selector action for builtin-discard:
>>> -2001
>>> 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg:
>>> -2001
>>> 7309.623914751:7ff800f7c700: config line NOT successfully processed
>>> 7309.623934707:7ff800f7c700: Called LogError, msg: the last error
>>> occured in /etc/rsyslog-test/rsyslog.d/**10-datanode.conf, line
>>> 1:":programname,isequal,"**DataNode" :omrelp:opbhdname001:20514;**
>>> RSYSLOG_ForwardFormat"
>>> rsyslogd: the last error occured in /etc/rsyslog-test/rsyslog.d/**10-datanode.conf,
>>> line 1:":programname,isequal,"**DataNode"
>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat"
>>>
>>> -----Original Message-----
>>>> From: rsyslog-bounces [at] lists**com<rsyslog-bounces [at] lists>[mailto:
>>>> rsyslog-
>>>> bounces [at] lists] On Behalf Of Steven Willis
>>>> Sent: Thursday, April 26, 2012 12:39 PM
>>>> To: rsyslog-users
>>>> Subject: Re: [rsyslog] error on app-name contains
>>>>
>>>> There was no particular reason to use app-name rather than programname,
>>>> but I still get the error when using programname:
>>>>
>>>> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in
>>>> /etc/rsyslog.d/10-datanode.**conf, line
>>>> 1:":programname,isequal,"**DataNode"
>>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat"
>>>>
>>>> -Steven Willis
>>>> ______________________________**__________
>>>> From: rsyslog-bounces [at] lists**com<rsyslog-bounces [at] lists>[rsyslog-
>>>> bounces [at] lists] On Behalf Of david [at] lang [david [at] lang]
>>>> Sent: Thursday, April 26, 2012 12:09 PM
>>>> To: rsyslog-users
>>>> Subject: Re: [rsyslog] error on app-name contains
>>>>
>>>> The other thing is that it may be that app-name doesn't exist in such
>>>> an old version.
>>>>
>>>> Why are you using app-name instead of programname?
>>>>
>>>> David Lang
>>>>
>>>> On Thu, 26 Apr 2012, Steven Willis wrote:
>>>>
>>>> Date: Thu, 26 Apr 2012 10:43:23 -0400
>>>>> From: Steven Willis <swillis [at] compete>
>>>>> Reply-To: rsyslog-users <rsyslog [at] lists>
>>>>> To: rsyslog-users <rsyslog [at] lists>
>>>>> Subject: Re: [rsyslog] error on app-name contains
>>>>>
>>>>> Well, I tried changing it to single quotes and that completely broke
>>>>>
>>>> rsyslog. It would crash on startup, no error messages or anything. I
>>>> also tried no quotes, but that failed just like single quotes. I also
>>>> tried adding spaces after the commas, but that made no difference. I
>>>> noticed that in the default redhat config all the modules had .so after
>>>> them, whereas my ubuntu config didn't. It seemed like I could do it
>>>> either way on the $ModLoad line, but perhaps I need to do :omrelp.so:
>>>> when using it?
>>>>
>>>>>
>>>>> -Steve
>>>>> ______________________________**__________
>>>>> From: rsyslog-bounces [at] lists**com<rsyslog-bounces [at] lists>
>>>>> [rsyslog-bounces [at] lists**adiscon.com<rsyslog-bounces [at] lists>]
>>>>> On Behalf Of david [at] lang
>>>>> [david [at] lang]
>>>>> Sent: Wednesday, April 25, 2012 8:29 PM
>>>>> To: rsyslog-users
>>>>> Subject: Re: [rsyslog] error on app-name contains
>>>>>
>>>>> the first thing that I always look at is should you use " or '
>>>>>
>>>> rsyslog
>>>>
>>>>> 4.x only accepts one, and I _think_ I remember it's '
>>>>>
>>>>> David Lang
>>>>>
>>>>> On Wed, 25 Apr 2012, Steven Willis wrote:
>>>>>
>>>>> Hi,
>>>>>>
>>>>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
>>>>>>
>>>>>> :app-name,contains,"DataNode"
>>>>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat
>>>>>>
>>>>>> The error line in /var/log/messages is:
>>>>>>
>>>>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in
>>>>>>
>>>>> /etc/rsyslog.d/10-datanode.**conf, line 1:":app-name,contains,"**
>>>> DataNode"
>>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat"
>>>>
>>>>>
>>>>>> I don't get that error with 5.8.1 on ubuntu. I looked through the
>>>>>>
>>>>> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like I'm
>>>> doing it right, can you help me out?
>>>>
>>>>>
>>>>>> -Steven Willis
>>>>>> ______________________________**_________________
>>>>>> rsyslog mailing list
>>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>>
>>>>>> ______________________________**_________________
>>>>> rsyslog mailing list
>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>> ______________________________**_________________
>>>>> rsyslog mailing list
>>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>
>>>>> ______________________________**_________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> ______________________________**_________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>
>>> ______________________________**_________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>
>>> ______________________________**_________________
>> rsyslog mailing list
>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> ______________________________**_________________
>> rsyslog mailing list
>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>
>> ______________________________**_________________
> rsyslog mailing list
> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


rgerhards at hq

Apr 30, 2012, 9:26 AM

Post #11 of 11 (785 views)
Permalink
Re: error on app-name contains [In reply to]

Well, they actually should be in alphabetic order, at least the relevant
system call is done (as far as I remember). If you are very sure it is inode,
I can check the code...

Rainer

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Brian Knox
> Sent: Monday, April 30, 2012 5:43 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] error on app-name contains
>
> The files are read in inode order. At the last place I worked we
> instituted a policy that all rsyslog conf files in the .d directory needed
> to be completely self contained and not rely on any other part of the conf
> because of this. It'll save you some headaches.
>
> Brian
>
> On Fri, Apr 27, 2012 at 12:17 PM, <david [at] lang> wrote:
>
> > On Fri, 27 Apr 2012, Steven Willis wrote:
> >
> > Ah, I think I figured it out. I put the directive to load omrelp and the
> >> filter that used it into different files under /etc/rsyslog.d/. The file
> >> containing the load statement was being processes after the file
containing
> >> the filter so omrelp wasn't yet available. I still don't know why the
exact
> >> same setup worked on my other boxes. Are filters lazily evaluated in
later
> >> versions of rsyslog?
> >>
> >
> > I don't believe that there is any lazy evaluation in the config files. I
> > believe that the files will get read in alpha order, but it's possible
that
> > they could be read in inode order. In any case, I would not have
> > dependancies between different files in /etc/rsyslog.d, the odds of it
> > causing grief later are just too high.
> >
> > David Lang
> >
> >
> > -Steven Willis
> >> ______________________________**__________
> >> From: rsyslog-bounces [at] lists**com<rsyslog-
> bounces [at] lists>[
> >> rsyslog-bounces [at] lists**adiscon.com <rsyslog-bounces [at] lists>]
> >> On Behalf Of david [at] lang [david [at] lang]
> >> Sent: Thursday, April 26, 2012 7:39 PM
> >> To: rsyslog-users
> >> Subject: Re: [rsyslog] error on app-name contains
> >>
> >> As I read this, it's failing in trying to figure out the action. Please
> >> try the same condition, but just writing to a file instead of to relp.
> >> that will tell us if it's the condition that's the problem or the
> >> destination.
> >>
> >> It's looking like relp may not be enabled on your build.
> >>
> >> David Lang
> >>
> >> On Thu, 26 Apr 2012, Steven Willis wrote:
> >>
> >> Here's the same run with -d
> >>>
> >>> 7309.623707350:7ff800f7c700: requested to include config file
> >>> '/etc/rsyslog-test/rsyslog.d/**10-datanode.conf'
> >>> 7309.623765755:7ff800f7c700: cfline:
> ':programname,isequal,"**DataNode"
> >>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat'
> >>> 7309.623786771:7ff800f7c700: - property-based filter
> >>> 7309.623813276:7ff800f7c700: tried selector action for builtin-file:
> >>> -2001
> >>> 7309.623831837:7ff800f7c700: tried selector action for builtin-pipe:
> >>> -2001
> >>> 7309.623848968:7ff800f7c700: tried selector action for builtin-fwd:
-2001
> >>> 7309.623865515:7ff800f7c700: tried selector action for builtin-shell:
> >>> -2001
> >>> 7309.623882173:7ff800f7c700: tried selector action for builtin-discard:
> >>> -2001
> >>> 7309.623898565:7ff800f7c700: tried selector action for builtin-usrmsg:
> >>> -2001
> >>> 7309.623914751:7ff800f7c700: config line NOT successfully processed
> >>> 7309.623934707:7ff800f7c700: Called LogError, msg: the last error
> >>> occured in /etc/rsyslog-test/rsyslog.d/**10-datanode.conf, line
> >>> 1:":programname,isequal,"**DataNode"
> :omrelp:opbhdname001:20514;**
> >>> RSYSLOG_ForwardFormat"
> >>> rsyslogd: the last error occured in /etc/rsyslog-test/rsyslog.d/**10-
> datanode.conf,
> >>> line 1:":programname,isequal,"**DataNode"
> >>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat"
> >>>
> >>> -----Original Message-----
> >>>> From: rsyslog-bounces [at] lists**com<rsyslog-
> bounces [at] lists>[mailto:
> >>>> rsyslog-
> >>>> bounces [at] lists] On Behalf Of Steven Willis
> >>>> Sent: Thursday, April 26, 2012 12:39 PM
> >>>> To: rsyslog-users
> >>>> Subject: Re: [rsyslog] error on app-name contains
> >>>>
> >>>> There was no particular reason to use app-name rather than
> programname,
> >>>> but I still get the error when using programname:
> >>>>
> >>>> Apr 26 12:36:57 opbhddata001 rsyslogd: the last error occured in
> >>>> /etc/rsyslog.d/10-datanode.**conf, line
> >>>> 1:":programname,isequal,"**DataNode"
> >>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat"
> >>>>
> >>>> -Steven Willis
> >>>> ______________________________**__________
> >>>> From: rsyslog-bounces [at] lists**com<rsyslog-
> bounces [at] lists>[rsyslog-
> >>>> bounces [at] lists] On Behalf Of david [at] lang
> [david [at] lang]
> >>>> Sent: Thursday, April 26, 2012 12:09 PM
> >>>> To: rsyslog-users
> >>>> Subject: Re: [rsyslog] error on app-name contains
> >>>>
> >>>> The other thing is that it may be that app-name doesn't exist in such
> >>>> an old version.
> >>>>
> >>>> Why are you using app-name instead of programname?
> >>>>
> >>>> David Lang
> >>>>
> >>>> On Thu, 26 Apr 2012, Steven Willis wrote:
> >>>>
> >>>> Date: Thu, 26 Apr 2012 10:43:23 -0400
> >>>>> From: Steven Willis <swillis [at] compete>
> >>>>> Reply-To: rsyslog-users <rsyslog [at] lists>
> >>>>> To: rsyslog-users <rsyslog [at] lists>
> >>>>> Subject: Re: [rsyslog] error on app-name contains
> >>>>>
> >>>>> Well, I tried changing it to single quotes and that completely broke
> >>>>>
> >>>> rsyslog. It would crash on startup, no error messages or anything. I
> >>>> also tried no quotes, but that failed just like single quotes. I also
> >>>> tried adding spaces after the commas, but that made no difference. I
> >>>> noticed that in the default redhat config all the modules had .so
after
> >>>> them, whereas my ubuntu config didn't. It seemed like I could do it
> >>>> either way on the $ModLoad line, but perhaps I need to do :omrelp.so:
> >>>> when using it?
> >>>>
> >>>>>
> >>>>> -Steve
> >>>>> ______________________________**__________
> >>>>> From: rsyslog-bounces [at] lists**com<rsyslog-
> bounces [at] lists>
> >>>>> [rsyslog-bounces [at] lists**adiscon.com<rsyslog-
> bounces [at] lists>]
> >>>>> On Behalf Of david [at] lang
> >>>>> [david [at] lang]
> >>>>> Sent: Wednesday, April 25, 2012 8:29 PM
> >>>>> To: rsyslog-users
> >>>>> Subject: Re: [rsyslog] error on app-name contains
> >>>>>
> >>>>> the first thing that I always look at is should you use " or '
> >>>>>
> >>>> rsyslog
> >>>>
> >>>>> 4.x only accepts one, and I _think_ I remember it's '
> >>>>>
> >>>>> David Lang
> >>>>>
> >>>>> On Wed, 25 Apr 2012, Steven Willis wrote:
> >>>>>
> >>>>> Hi,
> >>>>>>
> >>>>>> I'm getting an error with rsyslog 4.6.2 on redhat 6 with the line:
> >>>>>>
> >>>>>> :app-name,contains,"DataNode"
> >>>>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat
> >>>>>>
> >>>>>> The error line in /var/log/messages is:
> >>>>>>
> >>>>>> Apr 25 19:51:55 opbhddata001 rsyslogd: the last error occured in
> >>>>>>
> >>>>> /etc/rsyslog.d/10-datanode.**conf, line 1:":app-name,contains,"**
> >>>> DataNode"
> >>>> :omrelp:opbhdname001:20514;**RSYSLOG_ForwardFormat"
> >>>>
> >>>>>
> >>>>>> I don't get that error with 5.8.1 on ubuntu. I looked through the
> >>>>>>
> >>>>> documentation under /usr/share/doc/rsyslog-4.6.2 and it looks like
I'm
> >>>> doing it right, can you help me out?
> >>>>
> >>>>>
> >>>>>> -Steven Willis
> >>>>>> ______________________________**_________________
> >>>>>> rsyslog mailing list
> >>>>>>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >>>>>> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>>>>>
> >>>>>> ______________________________**_________________
> >>>>> rsyslog mailing list
> >>>>>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >>>>> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>>>> ______________________________**_________________
> >>>>> rsyslog mailing list
> >>>>>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >>>>> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>>>>
> >>>>> ______________________________**_________________
> >>>> rsyslog mailing list
> >>>>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >>>> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>>> ______________________________**_________________
> >>>> rsyslog mailing list
> >>>>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >>>> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>>>
> >>> ______________________________**_________________
> >>> rsyslog mailing list
> >>>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >>> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>>
> >>> ______________________________**_________________
> >> rsyslog mailing list
> >>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> ______________________________**_________________
> >> rsyslog mailing list
> >>
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> >> http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>
> >> ______________________________**_________________
> > rsyslog mailing list
> >
>
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/
mail
> man/listinfo/rsyslog>
> > http://www.rsyslog.com/**professional-
> services/<http://www.rsyslog.com/professional-services/>
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

RSyslog users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.