On 01/28/2014 05:51 PM, James Lertora wrote: > John, > > rsyslog is starting sec. If I use service to stop rsyslog, sec will > stop. If I use service to start rsyslog, sec starts up too. > > [root@host]# ps -ef | grep rsyslog > root 4209 1 0 10:45 ? 00:00:00 /sbin/rsyslogd -i > /var/run/syslogd.pid > - > and > - > [root@host]# ps -ef | grep sec > root 4214 4209 0 10:45 ? 00:00:00 /bin/bash > /usr/local/bin/sec.sh > root 4216 4214 0 10:45 ? 00:00:00 /usr/bin/perl -w > /usr/bin/sec --conf=/etc/sec/sec.conf --notail --input=- > > > > > I am not sure how to check with the "kill -USR1" or where to check the > dump file.
Assuming that the sec process ID is 4216 as in the above process list, just send this process the USR1 signal: kill -USR1 4216 This will produce /tmp/sec.dump dump file which contains a lot of info about sec internals, including the lines which have been read from inputs. If you are not seeing any input delivered to sec, make sure there are no ~ destinations used in rsyslog conf file. For example, the following statements *.* ~ *.* /var/log/all.log will not write anything to /var/log/all.log, since *.* ~ discards all messages without considering any further statements. regards, risto > > Thanks. > > > > > On Tue, Jan 28, 2014 at 10:42 AM, John P. Rouillard <[email protected] > <mailto:[email protected]>> wrote: > > > Hi James: > > In message > <cabboveiljfthaenmhs9yojossqbfhh--crbuxsww3ner1_f...@mail.gmail.com > > <mailto:cabboveiljfthaenmhs9yojossqbfhh--crbuxsww3ner1_f...@mail.gmail.com>> > , > James Lertora writes: > > [...] > >If I point sec (/etc/sysconfig/sec) to the current days syslogs > are at, > >then life is good, so I need to use named pipes. > > > >I am using RHEL 6.5 > >rsyslogd -v > >rsyslogd 7.4.9, compiled with: > > FEATURE_REGEXP: Yes > > FEATURE_LARGEFILE: No > > GSSAPI Kerberos 5 support: Yes > > FEATURE_DEBUG (debug build, slow code): No > > 32bit Atomic operations supported: Yes > > 64bit Atomic operations supported: Yes > > Runtime Instrumentation (slow code): No > > uuid support: Yes > >- > >SEC (Simple Event Correlator) 2.7.4 > >l > >I have this in my rsyslog.conf: > >Module (load="omprog") > >*.* action(type="omprog" > > binary="/usr/local/bin/sec.sh" > > template="RSYSLOG_TraditionalFileFormat") > >- > >sec.sh contains: > >#!/bin/bash > >usr/bin/sec --conf=/etc/sec/sec.conf --notail --input=- > > > >But I cannot seem to get log messages to actually get handled by sec. > > Just to note, I assume usr/bin/sec is a typo and not what is in your > .sh file? > > Also is sec being started by rsyslog? ps -ef should tell you that. > > Deos sending the running SEC a kill -USR1 and looking ta the dump file > show that the input stream is open? Are there any events in the event > buffer? > > -- > -- rouilj > John Rouillard > > =========================================================================== > My employers don't acknowledge my existence much less my opinions. > > > > > ------------------------------------------------------------------------------ > WatchGuard Dimension instantly turns raw network data into actionable > security intelligence. It gives you real-time visual feedback on key > security issues and trends. Skip the complicated setup - simply import > a virtual appliance and go from zero to informed in seconds. > http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk > > > > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ WatchGuard Dimension instantly turns raw network data into actionable security intelligence. It gives you real-time visual feedback on key security issues and trends. Skip the complicated setup - simply import a virtual appliance and go from zero to informed in seconds. http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
