try changing sec-comware to redirect stdout and stderr from sec to some file so that you can see what it's complaining about.
David Lang On Wed, 26 Jun 2013, Orangepeel Beef wrote: > Date: Wed, 26 Jun 2013 16:56:04 -0700 > From: Orangepeel Beef <[email protected]> > To: [email protected] > Subject: [Simple-evcorr-users] rsyslog omprog + SEC > > Having issues with rsyslog + SEC. The re_match's seem to be working (I > can see rsyslog launching the /usr/lcoal/sbin/sec_comware script) but the > script seems to terminate instantly without any indication of why its doing > so. > > from rsyslog debug logs.. > > 0809.267568155:7f2ed2e89700: Called action(Batch), logging to omprog > 0809.267571242:7f2ed2e89700: submitBatch: enter, nElem 1 > 0809.267574040:7f2ed2e89700: tryDoAction 0x1d8a4a0, pnElem 1, nElem 1 > 0809.267577349:7f2ed2e89700: scriptExec: batch of 1 elements, active (nil), > active[0]:1 > 0809.267579849:7f2ed2e89700: IF > 0809.267585573:7f2ed2e89700: function 're_match' (id:7, params:2) > 0809.267595324:7f2ed2e89700: var '$fromhost' > 0809.267604389:7f2ed2e89700: string '^(as|cs|r).*' > 0809.267615970:7f2ed2e89700: eval expr 0x1d8a920, type 'F[70]' > 0809.267618634:7f2ed2e89700: rainerscript: executing function id 7 > 0809.267621398:7f2ed2e89700: eval expr 0x1d8a410, type 'V[86]' > 0809.267624950:7f2ed2e89700: rainerscript: var '$fromhost': ' > r0507.mydomain.com' > 0809.267628549:7f2ed2e89700: batch: item 0: expr eval: 1 > 0809.267631336:7f2ed2e89700: scriptExec: batch of 1 elements, active > 0x7f2ec40008e0, active[0]:1 > 0809.267633685:7f2ed2e89700: ACTION 0x1d8b970 [:omprog:] > 0809.267639989:7f2ed2e89700: RRRR: execAct [omprog]: batch of 1 elements, > active 0x7f2ec40008e0 > 0809.267642986:7f2ed2e89700: Called action(NotAllMark), processing batch[0] > via 'omprog' > 0809.267645525:7f2ed2e89700: Called action(Batch), logging to omprog > 0809.267649554:7f2ed2e89700: submitBatch: enter, nElem 1 > 0809.267652361:7f2ed2e89700: tryDoAction 0x1d8b970, pnElem 1, nElem 1 > 0809.267655016:7f2ed2e89700: Action 0x1d8b970 transitioned to state: itx > 0809.267657566:7f2ed2e89700: entering actionCalldoAction(), state: itx > 0809.267662537:7f2ed2e89700: Program ''/usr/local/sbin/sec_comware'' > terminated, trying to restart > 0809.267669158:7f2ed2e89700: waitpid() returned state -1[No child > processes], future malfunction may happen > 0809.267675069:7f2ed2e89700: executing program > ''/usr/local/sbin/sec_comware'' > > > > #rsyslog config > > $ModLoad imudp > $UDPServerRun 514 > $ModLoad omprog > > > $template REMOTE,"/opt/log/remote/%fromhost%/%$YEAR%-%$MONTH%-%$DAY%.log" > > if re_match($fromhost,'^lb.*') then { > $actionomprogbinary '/usr/local/sbin/sec_netscaler' > *.* :omprog: > } > > if re_match($fromhost,'^(as|cs|r).*') then { > $actionomprogbinary '/usr/local/sbin/sec_comware' > *.* :omprog: > } > #stop so we don't process remote logs in the 50-default > if $fromhost-ip !='127.0.0.1' then { > ?REMOTE > stop > } > > #sec-comware > #!/bin/bash > CONF=comware > /usr/local/sbin/sec -conf=/usr/local/etc/sec/$CONF -pid=/tmp/sec-$CONF.pid > -dump=/tmp/sec-$CONF.dump -debug=5 -syslog=local1 -intevents -input=- > ------------------------------------------------------------------------------ This SF.net email is sponsored by Windows: Build for Windows Store. http://p.sf.net/sfu/windows-dev2dev _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
