On Fri, Jun 14, 2013 at 11:13 AM, Khushil Dep <[email protected]>wrote:
> Hey Rainer, > > rsyslog 7.4.0 (v7-stable) <http://www.rsyslog.com/rsyslog-7-4-0-v7-stable/ > > > > can you create and post a debug log? http://www.rsyslog.com/doc/troubleshoot.html Be warned that for a deep look, it will be early next week. But maybe I see something on quick look ;) Rainer > > No that's it no includes or anything else. > > As. Is. > > -- > Khushil Dep > 07905374843 > @khushil > > > > > > On 14/06/2013 10:06, "Rainer Gerhards" <[email protected]> wrote: > > >What is your rsyslog version? And just for clarity: was that the sole > >rsyslog.conf (no includes, no nothing...)? > > > >Rainer > > > > > >On Fri, Jun 14, 2013 at 11:03 AM, Khushil Dep > ><[email protected]>wrote: > > > >> Hi folks, > >> I have the following configuration: > >> > >> $ModLoad immark # provides --MARK-- message capability > >> $ModLoad imuxsock # provides support for local system logging (e.g. via > >> logger command) > >> $ModLoad imsolaris # kernel logging (imklog or imsolaris) > >> $ModLoad omrabbitmq # provides rabbitmq output > >> $ModLoad imudp.so # provides UDP syslog reception > >> $ModLoad imfile # provides FILE input > >> > >> $UDPServerRun 514 # start a UDP syslog server at standard port 514 > >> > >> # Save boot messages also to boot.log > >> *.* /var/log/syslog > >> > >> $template > >> malefantJSON,"{%timestamp:::date-rfc3339,jsonf:@timestamp > >> %,%source:::jsonf: > >> @source%,%source:::jsonf:@source_host > >> %,\"@message\":\"%msg:::json%\",\"@fie > >> > >>lds\":{%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::json > >>f: > >> severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%}}" > >> > >> $RepeatedMsgReduction off > >> > >> *.* action(type="omrabbitmq" > >> host="_HIDDEN_IP_ADDRESS_" > >> virtual_host="/" > >> user="pump" > >> password="dump" > >> exchange="syslog" > >> routing_key="syslog.all" > >> template="malefantJSON") > >> > >> However, some messages sent to syslog aren't being processed by the > >> action. For example in /var/log/syslog I see: > >> > >> 2013-06-14T09:49:59+00:00 mol-hsk-cfph2 node-syslog[23547]: [ID 702911 > >> user.emerg] OBVIOUS MESSAGE ALL IN CAPS <<<<<<<>>>>>>>>>> Fri Jun 14 > >>2013 > >> 09:49:59 GMT+0100 (GMT) > >> 2013-06-14T09:49:59+00:00 mol-hsk-cfph2 node-syslog[23547]: [ID 702911 > >> user.emerg] OBVIOUS MESSAGE ALL IN CAPS <<<<<<<>>>>>>>>>> Fri Jun 14 > >>2013 > >> 09:49:59 GMT+0100 (GMT) > >> 2013-06-14T09:50:00+00:00 mol-hsk-cfph2 node-syslog[23547]: [ID 702911 > >> user.emerg] OBVIOUS MESSAGE ALL IN CAPS <<<<<<<>>>>>>>>>> Fri Jun 14 > >>2013 > >> 09:50:00 GMT+0100 (GMT) > >> 2013-06-14T09:50:00+00:00 mol-hsk-cfph2 node-syslog[23547]: [ID 702911 > >> user.emerg] OBVIOUS MESSAGE ALL IN CAPS <<<<<<<>>>>>>>>>> Fri Jun 14 > >>2013 > >> 09:50:00 GMT+0100 (GMT) > >> 2013-06-14T09:50:00+00:00 mol-hsk-cfph2 node-syslog[23547]: [ID 702911 > >> user.emerg] OBVIOUS MESSAGE ALL IN CAPS <<<<<<<>>>>>>>>>> Fri Jun 14 > >>2013 > >> 09:50:00 GMT+0100 (GMT) > >> 2013-06-14T08:51:09+00:00 mol-hsk-cfph2 cf3[55035]: [ID 823470 > >>user.error] > >> There is no readable input file at /var/cfengine/inputs/update.cf > >> 2013-06-14T08:51:09+00:00 mol-hsk-cfph2 cf3[55035]: [ID 823470 > >>user.error] > >> !!! System reports error for stat: "No such file or directory" > >> 2013-06-14T08:51:09+00:00 mol-hsk-cfph2 cf3[55035]: [ID 823470 > >>user.error] > >> CFEngine was not able to get confirmation of promises from cf-promises, > >>so > >> going to failsafe > >> 2013-06-14T08:51:10+00:00 mol-hsk-cfph2 cf3[55035]: [ID 823470 > >> user.notice] R: -> Updated local policy from policy server > >> 2013-06-14T08:51:10+00:00 mol-hsk-cfph2 cf3[55035]: [ID 823470 > >> user.notice] R: !! Did not start the scheduler > >> 2013-06-14T08:51:12+00:00 mol-hsk-cfph2 cf3[55033]: [ID 823470 > >> user.notice] R: [MOLMSG-ERR] Persona classes cannot be raised as the > >> personas file is missing! > >> 2013-06-14T08:51:12+00:00 mol-hsk-cfph2 cf3[55033]: [ID 823470 > >> user.notice] R: [MOLMSG-INFO] No releaes file was found. That could be a > >> good or bad thing. > >> > >> the cf3 logs get sent off but the node-syslog messages don't. > >> > >> Any ideas as to why perhaps? > >> > >> -- > >> Khushil Dep > >> 07905374843 > >> @khushil > >> > >> ______________________________________________________________________ > >> This e-mail and any attached files are intended for the named addressee > >> only. It contains information, which may be confidential and legally > >> privileged and also protected by copyright. Unless you are the named > >> addressee (or authorised to receive for the addressee) you may not copy > >>or > >> use it, or disclose it to anyone else. If you received it in error > >>please > >> notify the sender immediately and then delete it from your system. > >>Please > >> be advised that the views and opinions expressed in this e-mail may not > >> reflect the views and opinions of Associated Newspapers Limited or any > >>of > >> its subsidiary companies. We make every effort to keep our network free > >> from viruses. However, you do need to check this e-mail and any > >>attachments > >> to it for viruses as we can take no responsibility for any computer > >>virus > >> which may be transferred by way of this e-mail. Use of this or any other > >> e-mail facility signifies consent to any interception we might lawfully > >> carry out to prevent abuse of these faciliti > >> es. > >> Associated Newspapers Ltd. Registered Office: Northcliffe House, 2 Derry > >> St, Kensington, London, W8 5TT. Registered No 84121 England. > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > >_______________________________________________ > >rsyslog mailing list > >http://lists.adiscon.net/mailman/listinfo/rsyslog > >http://www.rsyslog.com/professional-services/ > >What's up with rsyslog? Follow https://twitter.com/rgerhards > >NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >DON'T LIKE THAT. > > > >______________________________________________________________________ > >This email has been scanned by the Symantec Email Security.cloud service. > >For more information please visit http://www.symanteccloud.com > >______________________________________________________________________ > > ______________________________________________________________________ > This e-mail and any attached files are intended for the named addressee > only. It contains information, which may be confidential and legally > privileged and also protected by copyright. Unless you are the named > addressee (or authorised to receive for the addressee) you may not copy or > use it, or disclose it to anyone else. If you received it in error please > notify the sender immediately and then delete it from your system. Please > be advised that the views and opinions expressed in this e-mail may not > reflect the views and opinions of Associated Newspapers Limited or any of > its subsidiary companies. We make every effort to keep our network free > from viruses. However, you do need to check this e-mail and any attachments > to it for viruses as we can take no responsibility for any computer virus > which may be transferred by way of this e-mail. Use of this or any other > e-mail facility signifies consent to any interception we might lawfully > carry out to prevent abuse of these faciliti > es. > Associated Newspapers Ltd. Registered Office: Northcliffe House, 2 Derry > St, Kensington, London, W8 5TT. Registered No 84121 England. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
