depending on your distro SELinux or AppArmor may be preventing rsyslog from
writing to /tmp, stick it in /var/log to avoid that.
can you get a short debug dump during a time that you send such a log?
just to be sure, this local4 is not showing up on the client, but is showing up
on the central server??
David Lang
On Mon, 22 Apr 2024, Ian Diddams via rsyslog wrote:
Date: Mon, 22 Apr 2024 08:42:00 +0000
From: Ian Diddams via rsyslog <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Ian Diddams <ian.didd...@celebrus.com>
Subject: Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since
upgrade to ubuntu20
specifically look for 127.0.0.1 or localhost
see previous message . Nothing.
OK, Ive just set this up
local4.* /tmp/Tlocal.log
I created that log and chmod 777 for it to remove any silly potential issues
and restarted rsyslog on the central server
No change. Client logs have new entries. Server /var/log/Tlocal.log doesn’t
at all.
So it's either the server not accepting what is sent on local4 - but "logger -p
local4.info <string>" on the client DOES get centrally logged so that’s unlikely
OR
the client config isn’t capturing the additions to that local log for sending
i.e.
module(
load = "imfile"
pollingInterval = "1"
statefile.directory = "/var/log/node"
)
input(
type = "imfile"
tag = "tserv-stdout"
facility = "local4"
severity = "info"
file = "/var/log/node/Tlog.log"
)
cheers
ian
-----Original Message-----
From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of David Lang via
rsyslog
Sent: Friday, April 19, 2024 12:44 PM
To: David Lang via rsyslog <rsyslog@lists.adiscon.com>
Cc: David Lang <da...@lang.hm>
Subject: Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since
upgrade to ubuntu20
specifically look for 127.0.0.1 or localhost
If you can log anything that's local4 on the server to a single file (ideally
using the template RSYSLOG_DebugFormat so we can see all the variables that are
parsed from it) it may be easier to find the log than your current dynafile
approach that puts them in different directories based on the hostname.
David Lang
Confidentiality notice: This email (and any attachment) is intended for the
addressee(s) named above. It may contain information of a confidential or
legally privileged nature. Unauthorised disclosure or use of this email (or any
attachment) is prohibited and may be unlawful. If you are not the intended
recipient, please delete the email from your systems, destroy any copies and
inform the sender immediately. Privacy notice: To find information on how we
collect, process and store data, please see our privacy statement on our
website https://www.celebrus.com/privacy-statement Disclaimer: All attachments
have been scanned for viruses. However, Celebrus Technologies Plc cannot accept
liability for any loss or damage you may incur as a result of virus infection.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
