In this case the problem turned out to me that he could not use quotes in the
rsyslog config when defining the binary to run
so the line
$actionomprogbinary '/usr/local/sbin/sec_netscaler'
needed to be changed to
$actionomprogbinary /usr/local/sbin/sec_netscaler
the latest development version (as of yesterday, git version) of rsyslog allows
a newer syntax to be used that allows for command-line arguments to be used on
the command.
David Lang
On Thu, 27 Jun 2013, Risto Vaarandi wrote:
> Date: Thu, 27 Jun 2013 11:14:15 +0300
> From: Risto Vaarandi <[email protected]>
> To: [email protected]
> Subject: Re: [Simple-evcorr-users] rsyslog omprog + SEC
>
> ...apart from other suggestions, I'd also recommend to run sec with the
> --log option, so that its log messages would be written into a file.
> Since by default sec is logging at the 'debug' level, you will see a lot
> of information about its startup and execution.
> kind regards,
> risto
>
> On 06/27/2013 02:56 AM, Orangepeel Beef wrote:
>> Having issues with rsyslog + SEC. The re_match's seem to be working (I
>> can see rsyslog launching the /usr/lcoal/sbin/sec_comware script) but
>> the script seems to terminate instantly without any indication of why
>> its doing so.
>>
>> from rsyslog debug logs..
>>
>> 0809.267568155:7f2ed2e89700: Called action(Batch), logging to omprog
>> 0809.267571242:7f2ed2e89700: submitBatch: enter, nElem 1
>> 0809.267574040:7f2ed2e89700: tryDoAction 0x1d8a4a0, pnElem 1, nElem 1
>> 0809.267577349:7f2ed2e89700: scriptExec: batch of 1 elements, active
>> (nil), active[0]:1
>> 0809.267579849:7f2ed2e89700: IF
>> 0809.267585573:7f2ed2e89700: function 're_match' (id:7, params:2)
>> 0809.267595324:7f2ed2e89700: var '$fromhost'
>> 0809.267604389:7f2ed2e89700: string '^(as|cs|r).*'
>> 0809.267615970:7f2ed2e89700: eval expr 0x1d8a920, type 'F[70]'
>> 0809.267618634:7f2ed2e89700: rainerscript: executing function id 7
>> 0809.267621398:7f2ed2e89700: eval expr 0x1d8a410, type 'V[86]'
>> 0809.267624950:7f2ed2e89700: rainerscript: var '$fromhost':
>> 'r0507.mydomain.com <http://r0507.mydomain.com>'
>> 0809.267628549:7f2ed2e89700: batch: item 0: expr eval: 1
>> 0809.267631336:7f2ed2e89700: scriptExec: batch of 1 elements, active
>> 0x7f2ec40008e0, active[0]:1
>> 0809.267633685:7f2ed2e89700: ACTION 0x1d8b970 [:omprog:]
>> 0809.267639989:7f2ed2e89700: RRRR: execAct [omprog]: batch of 1
>> elements, active 0x7f2ec40008e0
>> 0809.267642986:7f2ed2e89700: Called action(NotAllMark), processing
>> batch[0] via 'omprog'
>> 0809.267645525:7f2ed2e89700: Called action(Batch), logging to omprog
>> 0809.267649554:7f2ed2e89700: submitBatch: enter, nElem 1
>> 0809.267652361:7f2ed2e89700: tryDoAction 0x1d8b970, pnElem 1, nElem 1
>> 0809.267655016:7f2ed2e89700: Action 0x1d8b970 transitioned to state: itx
>> 0809.267657566:7f2ed2e89700: entering actionCalldoAction(), state: itx
>> 0809.267662537:7f2ed2e89700: Program ''/usr/local/sbin/sec_comware''
>> terminated, trying to restart
>> 0809.267669158:7f2ed2e89700: waitpid() returned state -1[No child
>> processes], future malfunction may happen
>> 0809.267675069:7f2ed2e89700: executing program
>> ''/usr/local/sbin/sec_comware''
>>
>>
>>
>> #rsyslog config
>>
>> $ModLoad imudp
>> $UDPServerRun 514
>> $ModLoad omprog
>> $template REMOTE,"/opt/log/remote/%fromhost%/%$YEAR%-%$MONTH%-%$DAY%.log"
>> if re_match($fromhost,'^lb.*') then {
>> $actionomprogbinary '/usr/local/sbin/sec_netscaler'
>> *.* :omprog:
>> }
>> if re_match($fromhost,'^(as|cs|r).*') then {
>> $actionomprogbinary '/usr/local/sbin/sec_comware'
>> *.* :omprog:
>> }
>> #stop so we don't process remote logs in the 50-default
>> if $fromhost-ip !='127.0.0.1' then {
>> ?REMOTE
>> stop
>> }
>>
>> #sec-comware
>> #!/bin/bash
>> CONF=comware
>> /usr/local/sbin/sec -conf=/usr/local/etc/sec/$CONF
>> -pid=/tmp/sec-$CONF.pid -dump=/tmp/sec-$CONF.dump -debug=5
>> -syslog=local1 -intevents -input=-
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> This SF.net email is sponsored by Windows:
>>
>> Build for Windows Store.
>>
>> http://p.sf.net/sfu/windows-dev2dev
>>
>>
>>
>> _______________________________________________
>> Simple-evcorr-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Windows:
>
> Build for Windows Store.
>
> http://p.sf.net/sfu/windows-dev2dev
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
