Afternoon all! So I’ve encountered another syntax problem.. this time with a specific rsyslog.d/conf file. Here’s an error snippet:
root@server:/etc/rsyslog.d# rsyslogd -N1 -f 15-remote-syslog.conf rsyslogd: version 8.2112.0, config validation run (level 1), master config 15-remote-syslog.conf rsyslogd: input module name 'imudp' is unknown [v8.2112.0 try https://www.rsyslog.com/e/2209 ] rsyslogd: error during parsing file 15-remote-syslog.conf, on or before line 83: parameter 'ruleset' not known -- typo in config file? [v8.2112.0 try https://www.rsyslog.com/e/2207 ] rsyslogd: error during parsing file 15-remote-syslog.conf, on or before line 83: parameter 'port' not known -- typo in config file? [v8.2112.0 try https://www.rsyslog.com/e/2207 ] rsyslogd: input module name 'imudp' is unknown [v8.2112.0 try https://www.rsyslog.com/e/2209 ] rsyslogd: error during parsing file 15-remote-syslog.conf, on or before line 84: parameter 'ruleset' not known -- typo in config file? [v8.2112.0 try https://www.rsyslog.com/e/2207 ] And so on from line 83 – 94, which is the entire binding block. The conf file is long so I won’t paste the entire contents but here is a snippet: ruleset(name="amp20528" queue.type="linkedlist" queue.workerThreads="4" queue.workerThreadMinimumMessages="20000"){ action(type="omfile" file="/var/log/remote-syslog/amp.log" ioBufferSize="64k" flushOnTXEnd="off") } input(type="imudp" port="20514" ruleset="switches20514") There are 12 rulesets, with 12 inputs/bindings at the bottom of the file. The quotation marks are 100% correct, as well as the other punctuation marks. Each ruleset is identical save the name and log file name (meaning the paths are the same). Rsyslog.conf contains: $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support (previously done by rklogd) $ModLoad immark # provides --MARK-- message capability module(load="imudp") input(type="imudp" port=["20514","20515","20516","20517","20518","20519","20520","20524","20525","20526","20527","20528"] name="" name.appendPort="on") module(load="impstats" interval="10" log.file="/var/log/rsyslog_stats.log" log.syslog="off") (the default lines for file permissions and the $Include statement at the bottom) I’ve been fighting this for about 5 hours today trying all manner of things. I eliminated the possibility of file encoding issues.. all the forking conf files are us-ascii just like this one. I get the feeling that the module load might be the source of the problem but I came across a RH forum post showing the defining of the bindings, in rsyslog.conf directly under the module(load=”imudp”) line.. maybe that’s it? Thanks! [Jamf] Ben Hart IT Systems Administrator II 100 Washington Ave S, Minneapolis, MN 55401 [Phone] +00 1 989 424 0187 [Email] ben.h...@jamf.com [Web] www.jamf.com<https://www.jamf.com> [Facebook] [Twitter] [LinkedIn] [YouTube]
_______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
