any suggestions on how to make that work? all the ways i have tried do not
work when rsyslog executes them but work when i do it manually as the
syslog user
On Wed, Jun 26, 2013 at 4:01 PM, David Lang <[email protected]> wrote:
> try changing sec-comware to redirect stdout and stderr from sec to some
> file so that you can see what it's complaining about.
>
> David Lang
>
> On Wed, 26 Jun 2013, Orangepeel Beef wrote:
>
> Date: Wed, 26 Jun 2013 16:56:04 -0700
>> From: Orangepeel Beef <[email protected]>
>> To:
>> simple-evcorr-users@lists.**sourceforge.net<[email protected]>
>> Subject: [Simple-evcorr-users] rsyslog omprog + SEC
>>
>>
>> Having issues with rsyslog + SEC. The re_match's seem to be working (I
>> can see rsyslog launching the /usr/lcoal/sbin/sec_comware script) but the
>> script seems to terminate instantly without any indication of why its
>> doing
>> so.
>>
>> from rsyslog debug logs..
>>
>> 0809.267568155:7f2ed2e89700: Called action(Batch), logging to omprog
>> 0809.267571242:7f2ed2e89700: submitBatch: enter, nElem 1
>> 0809.267574040:7f2ed2e89700: tryDoAction 0x1d8a4a0, pnElem 1, nElem 1
>> 0809.267577349:7f2ed2e89700: scriptExec: batch of 1 elements, active
>> (nil),
>> active[0]:1
>> 0809.267579849:7f2ed2e89700: IF
>> 0809.267585573:7f2ed2e89700: function 're_match' (id:7, params:2)
>> 0809.267595324:7f2ed2e89700: var '$fromhost'
>> 0809.267604389:7f2ed2e89700: string '^(as|cs|r).*'
>> 0809.267615970:7f2ed2e89700: eval expr 0x1d8a920, type 'F[70]'
>> 0809.267618634:7f2ed2e89700: rainerscript: executing function id 7
>> 0809.267621398:7f2ed2e89700: eval expr 0x1d8a410, type 'V[86]'
>> 0809.267624950:7f2ed2e89700: rainerscript: var '$fromhost': '
>> r0507.mydomain.com'
>> 0809.267628549:7f2ed2e89700: batch: item 0: expr eval: 1
>> 0809.267631336:7f2ed2e89700: scriptExec: batch of 1 elements, active
>> 0x7f2ec40008e0, active[0]:1
>> 0809.267633685:7f2ed2e89700: ACTION 0x1d8b970 [:omprog:]
>> 0809.267639989:7f2ed2e89700: RRRR: execAct [omprog]: batch of 1 elements,
>> active 0x7f2ec40008e0
>> 0809.267642986:7f2ed2e89700: Called action(NotAllMark), processing
>> batch[0]
>> via 'omprog'
>> 0809.267645525:7f2ed2e89700: Called action(Batch), logging to omprog
>> 0809.267649554:7f2ed2e89700: submitBatch: enter, nElem 1
>> 0809.267652361:7f2ed2e89700: tryDoAction 0x1d8b970, pnElem 1, nElem 1
>> 0809.267655016:7f2ed2e89700: Action 0x1d8b970 transitioned to state: itx
>> 0809.267657566:7f2ed2e89700: entering actionCalldoAction(), state: itx
>> 0809.267662537:7f2ed2e89700: Program ''/usr/local/sbin/sec_comware'**'
>> terminated, trying to restart
>> 0809.267669158:7f2ed2e89700: waitpid() returned state -1[No child
>> processes], future malfunction may happen
>> 0809.267675069:7f2ed2e89700: executing program
>> ''/usr/local/sbin/sec_comware'**'
>>
>>
>>
>> #rsyslog config
>>
>> $ModLoad imudp
>> $UDPServerRun 514
>> $ModLoad omprog
>>
>>
>> $template REMOTE,"/opt/log/remote/%**fromhost%/%$YEAR%-%$MONTH%-%$**
>> DAY%.log"
>>
>> if re_match($fromhost,'^lb.*') then {
>> $actionomprogbinary '/usr/local/sbin/sec_**netscaler'
>> *.* :omprog:
>> }
>>
>> if re_match($fromhost,'^(as|cs|r)**.*') then {
>> $actionomprogbinary '/usr/local/sbin/sec_comware'
>> *.* :omprog:
>> }
>> #stop so we don't process remote logs in the 50-default
>> if $fromhost-ip !='127.0.0.1' then {
>> ?REMOTE
>> stop
>> }
>>
>> #sec-comware
>> #!/bin/bash
>> CONF=comware
>> /usr/local/sbin/sec -conf=/usr/local/etc/sec/$CONF -pid=/tmp/sec-$CONF.pid
>> -dump=/tmp/sec-$CONF.dump -debug=5 -syslog=local1 -intevents -input=-
>>
>>
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
