El mié., 3 abr. 2019 a las 17:13, Gorman, Kevin
(<[email protected]>) escribió:
>
> I'm using any and all docs on https://www.rsyslog.com/doc/v8-stable, posts on
> the internet, etc. The thing is there are few actual configuration examples
> and info on how to actually use the various syntax for rsyslog, but lots of
> references on what individual parts do, which makes it difficult for someone
> not familiar with it to get anything done.
I asked because the parameters you gave simply did not exist, thus the
syntax error. The online doc is for the currently selected version.
With outdated versions like 8.24.0 you should probably stick to the OS
provided doc package. That just as info.
It is impossible to provide full config examples for everything -
there are more potential configs than atoms in the universe (really!).
It would be good if users would contribute their configs to the doc,
but this does not happen so far :-(
>
> The version is 8.24 on RHEL 7.6 using the default rsyslog.conf. Here is the
> complete config.
>
> There is no problem collecting or forwarding log data defined in
> rsyslog.conf. I simply want to define the address, port and protocol once and
> only once.
>
> I am having trouble forwarding the other 2 sample log files, or rather
> audit.log since ansible.log is always empty. Audit.log is not defined in
> rsyslog.conf and is pretty busy, but I don't see data in tcpdump on the local
> server or in the remote log server.
>
> From the debug output below, everything looks ok to me.
>
Let me have a look. Warning: I don't remember what was at the time we
had 8.24 (probably 2.5 yrs ago),
> # cat rsyslog.all.conf
> module(load="imfile" mode="inotify")
>
> global (
> parser.dropTrailingLFOnReception="on"
> parser.escapeControlCharactersOnReceive="on"
> workDirectory="/var/lib/rsyslog"
> )
>
> ruleset(name="linux_forward") {
> action(
> type="omfwd"
> target="2001:4888:a00:3154:f0:ff2:0:b01" # logserver VIP
> protocol="tcp"
> port="5544"
> )
> stop
stop is unnecessary here, but causes no issue.
> }
>
> *.* action(
> type="omfwd"
> target="2001:4888:a00:3154:f0:ff2:0:b01"
> port="5544"
> protocol="tcp"
> )
replace by
call linux_forward
>
> # cat rsyslog.linux.conf
>
> input(
> type="imfile"
> ruleset="linux_forward"
> tag="ansible"
> file="/var/log/ansible.log"
> )
>
> input(
> type="imfile"
> ruleset="linux_forward"
> tag="audit"
> file="/var/log/audit/audit.log"
> )
looks good
>
> # grep -v ^# /etc/rsyslog.conf
>
> $ModLoad imuxsock # provides support for local system logging (e.g. via
> logger command)
> $ModLoad imjournal # provides access to the systemd journal
> $WorkDirectory /var/lib/rsyslog
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $IncludeConfig /etc/rsyslog.d/*.conf
> $OmitLocalLogging on
> $IMJournalStateFile imjournal.state
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
> authpriv.* /var/log/secure
> mail.* -/var/log/maillog
> cron.* /var/log/cron
> *.emerg :omusrmsg:*
> uucp,news.crit /var/log/spooler
> local7.* /var/log/boot.log
looks good
>
> # rsyslogd -N2 2>&1
> rsyslogd: version 8.24.0-34.el7, config validation run (level 2), master
> config /etc/rsyslog.conf
>
> 2612.391124552:main thread : debug level 2 set via config file
> 2612.391137687:main thread : This is rsyslog version 8.24.0-34.el7
> 2612.391142024:main thread : config parser: reached end of file
> /etc/rsyslog.d/rsyslog.debug.conf
at least one of the includede files is missing - if others are missing
they may have problems...
[snip]
> rsyslogd: End of config validation run. Bye.
>
except for the call, I don't see an issue.
As a test, do an upgrade to the currently supported version. If it
works, you have hit an already solved bug.
HTH
Rainer
>
>
>
> -----Original Message-----
> From: Rainer Gerhards [mailto:[email protected]]
> Sent: Wednesday, April 03, 2019 2:04 AM
> To: rsyslog-users
> Cc: Gorman, Kevin
> Subject: Re: [rsyslog] [E] Re: Help with newer syntax a ruleset and forwarding
>
> > *.* action(
> > type="omfwd"
> > ruleset="linux_forward"
> > tag="rsyslog"
> > name="rsyslog"
> > )
>
> Which doc do you use as reference for this? Or, more general, which doc link
> do you use to craft the configs?
>
> Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
