WelcomeWelcome | FAQFAQ | DownloadsDownloads | WikiWiki

Author Topic: Rsyslog not working  (Read 616 times)

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Rsyslog not working
« on: October 05, 2024, 08:05:22 AM »
Hi,
I have an application for which I want to create logging.
I basically have 2 types of logging:
- fast debug-alike logging, multiple lines per second, intended to scheck last few minutes only
- slow monitor alike logging, few lines per hour, intended to check last few days

I now monitor with syslog but than I need to chose: either have the fats logging enabled OR the monitor logging because the TCV uses the BusyBox syslogd that does not support syslog.conf

To overcome, I have installed Rsyslog app (tc 32bit version).
However... it does not work.
After few hours trying to figure out whether I did something wrong with conf file I finally did run with -d option. see logging below.
It seems that the version is incomplete. needs a dependancy...

Any tips?
1/
Is this something "I can fix", or will it be beyond my capabilities.
(of course you cannot know my capabilities, but I have some basic linux knowledge, I'm not a guru)
2/
alternatively: any idea how I can split the syslog into a "slow log" and a "fast log"?

Code: [Select]
tc@huis:~$ sudo rsyslogd -d > /home/tc/debug.txt
tc@huis:~$ cat debug.txt

9225.179870386:main thread    : rsyslogd.c: rsyslogd 8.2312.0 startup, module path '', cwd:/home/tc
9225.186794561:main thread    : glbl.c: rsyslog/glbl: using '127.0.0.1' as localhost IP
9225.187338019:main thread    : obj.c: caller requested object 'net', not found (iRet -3003)
9225.187481235:main thread    : modules.c: Requested to load module 'lmnet'
9225.187558653:main thread    : modules.c: loading module '/usr/local/lib/rsyslog/lmnet.so'
9225.189158546:main thread    : modules.c: module lmnet of type 2 being loaded (keepType=0).
9225.189217636:main thread    : net.c: entry point 'isCompatibleWithFeature' not present in module
9225.189240599:main thread    : net.c: entry point 'setModCnf' not present in module
9225.189263699:main thread    : net.c: entry point 'getModCnfName' not present in module
9225.189285884:main thread    : net.c: entry point 'beginCnfLoad' not present in module
9225.189327025:main thread    : modules.c: source file conf.c requested reference for module 'lmnet', reference count now 1
9225.189424527:main thread    : rsyslog.c: rsyslog runtime initialized, version 8.2312.0, current users 1
9225.189986766:main thread    : modules.c: source file rsyslogd.c requested reference for module 'lmnet', reference count now 2
9225.190238654:main thread    : omfile.c: omfile: using transactional output interface.
9225.195431926:main thread    : modules.c: module builtin:omfile of type 1 being loaded (keepType=0).
9225.196819703:main thread    : modules.c: module config name is 'omfile'
9225.196845110:main thread    : modules.c: module builtin:omfile supports rsyslog v6 config interface
9225.196877530:main thread    : omfile.c: entry point 'activateCnfPrePrivDrop' not present in module
9225.196915551:main thread    : omfile.c: entry point 'doHUPWrkr' not present in module
9225.196938767:main thread    : omfile.c: entry point 'SetShutdownImmdtPtr' not present in module
9225.196962957:main thread    : omfile.c: entry point 'doAction' not present in module
9225.196988082:main thread    : omfile.c: entry point 'endTransaction' not present in module
9225.197033087:main thread    : modules.c: module builtin:ompipe of type 1 being loaded (keepType=0).
9225.197703119:main thread    : modules.c: module config name is 'ompipe'
9225.197739951:main thread    : modules.c: module builtin:ompipe supports rsyslog v6 config interface
9225.197771994:main thread    : ompipe.c: entry point 'activateCnfPrePrivDrop' not present in module
9225.197809132:main thread    : ompipe.c: entry point 'doHUPWrkr' not present in module
9225.197832453:main thread    : ompipe.c: entry point 'SetShutdownImmdtPtr' not present in module
9225.197856110:main thread    : ompipe.c: entry point 'beginTransaction' not present in module
9225.197883440:main thread    : ompipe.c: entry point 'commitTransaction' not present in module
9225.197907310:main thread    : ompipe.c: entry point 'endTransaction' not present in module
9225.197945590:main thread    : modules.c: module builtin-shell of type 1 being loaded (keepType=0).
9225.197971733:main thread    : omshell.c: entry point 'setModCnf' not present in module
9225.197994769:main thread    : omshell.c: entry point 'getModCnfName' not present in module
9225.198017143:main thread    : omshell.c: entry point 'beginCnfLoad' not present in module
9225.198049612:main thread    : omshell.c: entry point 'doHUP' not present in module
9225.198072225:main thread    : omshell.c: entry point 'doHUPWrkr' not present in module
9225.198094543:main thread    : omshell.c: entry point 'SetShutdownImmdtPtr' not present in module
9225.198116899:main thread    : omshell.c: entry point 'beginTransaction' not present in module
9225.198141937:main thread    : omshell.c: entry point 'commitTransaction' not present in module
9225.198164303:main thread    : omshell.c: entry point 'endTransaction' not present in module
9225.198186631:main thread    : omshell.c: entry point 'newActInst' not present in module
9225.198218783:main thread    : modules.c: module builtin:omdiscard of type 1 being loaded (keepType=0).
9225.198244660:main thread    : omdiscard.c: entry point 'setModCnf' not present in module
9225.198328544:main thread    : omdiscard.c: entry point 'getModCnfName' not present in module
9225.198352235:main thread    : omdiscard.c: entry point 'beginCnfLoad' not present in module
9225.198385052:main thread    : omdiscard.c: entry point 'doHUP' not present in module
9225.198407957:main thread    : omdiscard.c: entry point 'doHUPWrkr' not present in module
9225.198430634:main thread    : omdiscard.c: entry point 'SetShutdownImmdtPtr' not present in module
9225.200622714:main thread    : omdiscard.c: entry point 'beginTransaction' not present in module
9225.200649658:main thread    : omdiscard.c: entry point 'commitTransaction' not present in module
9225.200672806:main thread    : omdiscard.c: entry point 'endTransaction' not present in module
9225.200695408:main thread    : omdiscard.c: entry point 'newActInst' not present in module
9225.200756042:main thread    : modules.c: source file omfwd.c requested reference for module 'lmnet', reference count now 3
9225.201217513:main thread    : modules.c: module builtin:omfwd of type 1 being loaded (keepType=0).
9225.201253206:main thread    : modules.c: module config name is 'omfwd'
9225.201276973:main thread    : modules.c: module builtin:omfwd supports rsyslog v6 config interface
9225.201309098:main thread    : omfwd.c: entry point 'activateCnfPrePrivDrop' not present in module
9225.201344190:main thread    : omfwd.c: entry point 'doHUP' not present in module
9225.201367704:main thread    : omfwd.c: entry point 'doHUPWrkr' not present in module
9225.201390967:main thread    : omfwd.c: entry point 'SetShutdownImmdtPtr' not present in module
9225.201414842:main thread    : omfwd.c: entry point 'doAction' not present in module
9225.201458658:main thread    : omfwd.c: entry point 'endTransaction' not present in module
9225.201494596:main thread    : modules.c: module builtin:omusrmsg of type 1 being loaded (keepType=0).
9225.201520783:main thread    : omusrmsg.c: entry point 'setModCnf' not present in module
9225.201545565:main thread    : modules.c: module config name is 'omusrmsg'
9225.201568310:main thread    : omusrmsg.c: entry point 'beginCnfLoad' not present in module
9225.201601580:main thread    : omusrmsg.c: entry point 'doHUP' not present in module
9225.201624689:main thread    : omusrmsg.c: entry point 'doHUPWrkr' not present in module
9225.201647476:main thread    : omusrmsg.c: entry point 'SetShutdownImmdtPtr' not present in module
9225.201670288:main thread    : omusrmsg.c: entry point 'beginTransaction' not present in module
9225.201696230:main thread    : omusrmsg.c: entry point 'commitTransaction' not present in module
9225.201719206:main thread    : omusrmsg.c: entry point 'endTransaction' not present in module
9225.201756190:main thread    : pmrfc5424.c: rfc5424 parser init called
9225.201779409:main thread    : pmrfc5424.c: GetParserName addr 0x4f9176
9225.201805662:main thread    : modules.c: module builtin:pmrfc5424 of type 3 being loaded (keepType=0).
9225.201830851:main thread    : pmrfc5424.c: entry point 'setModCnf' not present in module
9225.201853947:main thread    : pmrfc5424.c: entry point 'getModCnfName' not present in module
9225.201876197:main thread    : pmrfc5424.c: entry point 'beginCnfLoad' not present in module
9225.201899172:main thread    : pmrfc5424.c: entry point 'parse2' not present in module
9225.201929402:main thread    : parser.c: DDDDD: added parser 'rsyslog.rfc5424' to list 0xb782b1a0
9225.201952000:main thread    : parser.c: Parser 'rsyslog.rfc5424' added to list of available parsers.
9225.201984750:main thread    : pmrfc3164.c: rfc3164 parser init called
9225.202012736:main thread    : modules.c: module builtin:pmrfc3164 of type 3 being loaded (keepType=0).
9225.202038304:main thread    : pmrfc3164.c: entry point 'setModCnf' not present in module
9225.202062409:main thread    : modules.c: module config name is 'pmrfc3164'
9225.202084658:main thread    : pmrfc3164.c: entry point 'beginCnfLoad' not present in module
9225.202110814:main thread    : pmrfc3164.c: newParserInst (pmrfc3164)
9225.202187369:main thread    : parser.c: DDDDD: added parser 'rsyslog.rfc3164' to list 0xb782b1a0
9225.202209667:main thread    : parser.c: Parser 'rsyslog.rfc3164' added to list of available parsers.
9225.202236941:main thread    : parser.c: DDDDD: added parser 'rsyslog.rfc5424' to list 0xb782b1a4
9225.202259133:main thread    : parser.c: Parser 'rsyslog.rfc5424' added to default parser set.
9225.202283710:main thread    : parser.c: DDDDD: added parser 'rsyslog.rfc3164' to list 0xb782b1a4
9225.202305314:main thread    : parser.c: Parser 'rsyslog.rfc3164' added to default parser set.
9225.202331578:main thread    : smfile.c: rsyslog standard file format strgen init called, compiled with version 8.2312.0
9225.202359514:main thread    : modules.c: module builtin:smfile of type 4 being loaded (keepType=0).
9225.202383161:main thread    : smfile.c: entry point 'isCompatibleWithFeature' not present in module
9225.202405441:main thread    : smfile.c: entry point 'setModCnf' not present in module
9225.202427997:main thread    : smfile.c: entry point 'getModCnfName' not present in module
9225.202450034:main thread    : smfile.c: entry point 'beginCnfLoad' not present in module
9225.202482051:main thread    : strgen.c: Strgen 'RSYSLOG_FileFormat' added to list of available strgens.
9225.202508443:main thread    : smtradfile.c: traditional file format strgen init called, compiled with version 8.2312.0
9225.202535153:main thread    : modules.c: module builtin:smtradfile of type 4 being loaded (keepType=0).
9225.202558927:main thread    : smtradfile.c: entry point 'isCompatibleWithFeature' not present in module
9225.202581257:main thread    : smtradfile.c: entry point 'setModCnf' not present in module
9225.202604112:main thread    : smtradfile.c: entry point 'getModCnfName' not present in module
9225.202626306:main thread    : smtradfile.c: entry point 'beginCnfLoad' not present in module
9225.202653050:main thread    : strgen.c: Strgen 'RSYSLOG_TraditionalFileFormat' added to list of available strgens.
9225.202679858:main thread    : smfwd.c: rsyslog standard (network) forward format strgen init called, compiled with version 8.2312.0
9225.202706143:main thread    : modules.c: module builtin:smfwd of type 4 being loaded (keepType=0).
9225.202729706:main thread    : smfwd.c: entry point 'isCompatibleWithFeature' not present in module
9225.202751820:main thread    : smfwd.c: entry point 'setModCnf' not present in module
9225.202774320:main thread    : smfwd.c: entry point 'getModCnfName' not present in module
9225.202796219:main thread    : smfwd.c: entry point 'beginCnfLoad' not present in module
9225.202822270:main thread    : strgen.c: Strgen 'RSYSLOG_ForwardFormat' added to list of available strgens.
9225.202849105:main thread    : smtradfwd.c: rsyslog traditional (network) forward format strgen init called, compiled with version 8.2312.0
9225.202875786:main thread    : modules.c: module builtin:smtradfwd of type 4 being loaded (keepType=0).
9225.202899359:main thread    : smtradfwd.c: entry point 'isCompatibleWithFeature' not present in module
9225.202921612:main thread    : smtradfwd.c: entry point 'setModCnf' not present in module
9225.202944191:main thread    : smtradfwd.c: entry point 'getModCnfName' not present in module
9225.202966156:main thread    : smtradfwd.c: entry point 'beginCnfLoad' not present in module
9225.202992205:main thread    : strgen.c: Strgen 'RSYSLOG_TraditionalForwardFormat' added to list of available strgens.
9225.203015140:main thread    : rsconf.c: doing legacy config system init
9225.209190047:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_DebugFormat'
9225.213981766:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_SyslogProtocol23Format'
9225.214114791:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_SyslogRFC5424Format'
9225.214295670:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_FileFormat'
9225.214331195:main thread    : ../template.c: template bound to strgen 'RSYSLOG_FileFormat'
9225.214396301:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_TraditionalFileFormat'
9225.214425116:main thread    : ../template.c: template bound to strgen 'RSYSLOG_TraditionalFileFormat'
9225.214472440:main thread    : ../template.c: tplAddLine processing template ' WallFmt'
9225.214548562:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_ForwardFormat'
9225.214576887:main thread    : ../template.c: template bound to strgen 'RSYSLOG_ForwardFormat'
9225.214600262:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_TraditionalForwardFormat'
9225.214628360:main thread    : ../template.c: template bound to strgen 'RSYSLOG_TraditionalForwardFormat'
9225.214651183:main thread    : ../template.c: tplAddLine processing template ' StdUsrMsgFmt'
9225.214686620:main thread    : ../template.c: tplAddLine processing template ' StdDBFmt'
9225.214888884:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_SysklogdFileFormat'
9225.215006907:main thread    : ../template.c: tplAddLine processing template ' StdPgSQLFmt'
9225.215139792:main thread    : ../template.c: tplAddLine processing template ' StdJSONFmt'
9225.215329021:main thread    : ../template.c: tplAddLine processing template ' FullJSONFmt'
9225.215512709:main thread    : ../template.c: tplAddLine processing template ' StdClickHouseFmt'
9225.215605820:main thread    : ../template.c: tplAddLine processing template 'RSYSLOG_omudpspoofDfltSourceTpl'
9225.216492428:main thread    : lexer.l: config parser: pushed config fragment on top of stack:


>>> snip had to truncate log for reason of max forum message length <<<<

Offline andyj

  • Hero Member
  • *****
  • Posts: 1036
Re: Rsyslog not working
« Reply #1 on: October 05, 2024, 11:23:42 PM »
Can you post your rsyslog.conf file?

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #2 on: October 06, 2024, 02:16:50 AM »
Here you go,
Note, I never worked with syslog or Rsyslog so I'm "experimenting".
This is the most basic/simple rsyslog.conf that I would at least expect to create a file. No file is created though.
I'm alarmed by the huge amount of "not present in modules" messages in the output of rsyslog -d.

having said that... "it seems to be running". If I try to run it a 2nd time it complaints that its already running.

Note, I forgot to say in 1st post: running "core-15"

Code: [Select]
tc@huis:/usr/local/etc$ cat rsyslog.conf
*.* /home/tc/stefan
« Last Edit: October 06, 2024, 02:19:48 AM by Stefann »

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #3 on: October 06, 2024, 03:18:24 AM »
small update,
after some riding I updated the conf file like below.
I have no clue what all global directives do but based on what I could understand of the man page at least the "$ModLoad imuxsock" is necessary to make it listen to the syslog system. No success however...

Code: [Select]
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock

*.* /home/tc/stefan

Offline andyj

  • Hero Member
  • *****
  • Posts: 1036
Re: Rsyslog not working
« Reply #4 on: October 06, 2024, 06:31:45 AM »
The default location for the rsyslog.conf file is in /usr/local/etc. The command "rsyslogd -N1" will verify the config file. You will probably want to start with something like this and add your own templates and rulesets:

Code: [Select]
$WorkDirectory /srv/syslog/log/work

# This would queue _ALL_ rsyslog messages, i.e. slow them down to rate of DB ingest.
# Don't do that...
# $MainMsgQueueFileName mainq  # set file name, also enables disk mode

# We only want to queue for database writes.
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName dbq    # set file name, also enables disk mode
$ActionResumeRetryCount -1   # infinite retries on insert failure

# Default Settings

# Load Modules

module(load="imuxsock")    # provides support for local system logging (e.g. via logger command)
module(load="imklog")      # provides kernel logging support (previously done by rklogd)
module(load="immark")      # provides --MARK-- message capability
module(load="impstats")

# Provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# Provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

My setup logs to postgresql. That requires setting up a database, designing a schema, and adding the appropriate templates and rulesets to the rsyslog.conf file. Whether you use a database or log file directories, you will need to manage disk space. It will fill up faster than you would think.

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #5 on: October 06, 2024, 08:14:20 AM »
It works!!!

either my 1st edit fixed it:

Code: [Select]
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock

Or my 2nd edit fixed it:
Code: [Select]
$WorkDirectory /var/log/work
I feel that it already worked after the 1st edit, but I did not notice as during the debugging I had set the logging to my home (to avoid authorization issues) but was checking /var/log for activity which was not there.

Anyway...
I did find some guidance on internet:

Code: [Select]
$ModLoad imuxsock

in order to receive log messages from local system processes. This
config directive should only left out if you know exactly what you
are doing.

Code: [Select]
$WorkDirectory /var/log/work
If no working directory set it defaults to root which will not work due to lacking authorization

All in all,
Thanks Andy for sharing your config.
It did help narrow down "what directives are really essential".
I did notice that you had the working directory set that I did not. That got me google on working directory on which I found that to be an essential directive.
And I got some confirmation that the other directives were ok.


« Last Edit: October 06, 2024, 08:15:57 AM by Stefann »

Offline andyj

  • Hero Member
  • *****
  • Posts: 1036
Re: Rsyslog not working
« Reply #6 on: October 06, 2024, 10:04:33 AM »
You may want to consider using separate (and probably persistent) file systems for your working directory and logs so you don't fill up RAM. Maybe something like this:

Code: [Select]
# rsyslog Templates

template (name="DynFile" type="string" string="/srv/syslog2/log/syslog-%$now-utc%.log")
template (name="DynStat" type="string" string="/srv/syslog2/log/pstats-%$now-utc%.log")

# rsyslog RuleSets

action(type="omfile" dynafile="DynFile")
if $syslogtag contains 'rsyslogd-pstats' then {
        action(type="omfile" queue.type="linkedlist" queue.discardmark="980" name="pstats" dynafile="DynStat")
        stop
}

I have my persistent file systems mounted under /srv mostly to avoid conflicts with /mnt, but I'm using a VM so adding file systems for additional space is a fairly simple task.

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #7 on: October 06, 2024, 11:10:06 AM »
Thanks!
This is how I now implemented it:
- only log my own application that uses local1 as identifier
- slow log for notice & info messages. This log has few lines per hour and provides a multi-day log
- error log for debug messages. This log has multiple lines per second. Typically one needs a few minutes of logging to debug something
(note, application only sends debugging information when that is enabled)

Andyj..... GOOD POINT......
I now realise that log rotation is not standard for Rsyslog. It can be done with the conf file. Not overly difficult but "adding complexity"
Boy..... I actually only did need the standard syslog to have a conf file... conf file however is not included with tiny core standard busy box version.
Will need to make the rotation before I use the debuggging

Note, I doNOT want to write to persistent filesystem. That is a FCcard that I want to write only 1x/day. That's actually what I love about tiny core.
But that's ok.
the "slow log" is really just a few lines per hour. it will take a m month before that becomes a megabyte
The "fast log" will definitely need a rotate. I don't need more history than 15mins or so, but it shall not eat my ram.

Code: [Select]
$WorkDirectory /var/log/work

$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock

$template MyFormat,"%timegenerated:1:19% %msg:::drop-last-lf%\n"


local1.=notice;local1.=info /var/log/slowlog.txt;MyFormat
local1.=debug /var/log/errorlog.txt;MyFormat

Offline andyj

  • Hero Member
  • *****
  • Posts: 1036
Re: Rsyslog not working
« Reply #8 on: October 06, 2024, 11:46:59 AM »
I can add a sample conf file the next time I update the extension. The problem with sample conf files though is that they cause other problems because people think that is all they need, then complain when that does not do what they want either.

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #9 on: October 06, 2024, 12:45:55 PM »
Hi,
I think I have rotation added:

Code: [Select]
$WorkDirectory /var/log/work

$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock

$template MyFormat,"%timegenerated:1:19% %msg:::drop-last-lf%\n"

#example (got that from the internet)
# $outchannel log_rotation,/var/log/log_rotation.log, 52428800,/home/me/./log_rotation_script
#  activate the channel and log everything to it
# *.* :omfile:$log_rotation
#
# /home/me/log_rotation_script:
# mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1

#max 100k debugfile = 1000 lines x 100chars
$outchannel debug_log,/var/log/errorlog.txt, 100000,/var/log/./rotate_debug


local1.=notice;local1.=info /var/log/slowlog.txt;MyFormat

# original before rotation:
# local1.=debug /var/log/errorlog.txt;MyFormat

# new with rotation:
local1.=debug :omfile:$debug_log;MyFormat

with /var/log/rotate_debug
Code: [Select]
tail -n 500 errorlog.txt > error.tmp
mv -f error.tmp errorlog.txt
(so I'm not getting a 2nd file but when file gets to max I only keep the last 500 lines and let it grow again)

the "slow part" sure works.
full testing the debug part will become next weekend.
Its live running
But I have fast debug-data disabled in the application.
That will need testing "under attention" which will become next weekend (I'm in Europe and day is ending)

And thanks again from being able to pull me from my "dead spot"
« Last Edit: October 06, 2024, 12:48:04 PM by Stefann »

Offline CentralWare

  • Retired Admins
  • Hero Member
  • *****
  • Posts: 758
Re: Rsyslog not working
« Reply #10 on: October 06, 2024, 09:06:45 PM »
@andyj: IF there's a default config file at the author's website, I find that's a great place to start.  (Think of MySQL or PHP - theirs are like having the entire manpages in a single document.)

1. Your .info file should state "...the enclosed /usr/local/etc/filename.conf is for testing only, it is not guaranteed or expected to suit your specific needs."  The .info should also state what defaults are implemented, if any, and which files to edit should they wish to make such changes.

When possible, add a link to .info pointing to help, install or "how to" pages at the author website.  Make .info do your bidding!  Our jobs are not to teach people the basics of computing...  or Linux itself (though we find ourselves doing no less at times) and even with the mainstream repos out there...  help the masses as best you can, preferably with one or two attempts.  For the Joe Schmo who wants this and that and the other thing which are very specific and helpful mostly just to them...  we call those individuals "clients" depending on the circumstances.

2. The config(s) you do choose to enclose, just make sure that with those files, the application(s) start without error and can be tested using those configs.  They may not do what the user wants to do in the end...  but there's no way to know what exactly that would be and they would be a great starting point as opposed to nothing at all.  I lean toward averages - out of the next 100 people, these features/functions are usually requested by most...  and set up configs to match.
Quote
You can please some of the people, some of the time...
MariaDB example: Just have it configured to use path=/home/tc/mysql user=tc group=staff and have tce.installed just mkdir -p /users/tc/mysql if it doesn't already exist -- the user can alter the defaults as they please.  Me, personally, I also run a check to see if the default mysql database was created; if not, run the basic initialize from /usr/local/etc/init.d/mysql.sh or mariadb.sh (this is also done with init.d files from Fedora, CentOS, RHEL and others so it tends to be accepted and sometimes appreciated.  The goal here is to offer our users building blocks that work out of the box...  and allow them to modify these OOBs to suit their specific desires.  The Mods they implement tend to be what's most useful for the community to chip in with advice as long as there's a common starting point.

3. If and when there's a user who complains an extension isn't configured just the way they want it to be, point them to the .info file.  If you've spent time helping someone set up a configuration, put the forum URL in the .info file!  People helping people get stuck repeating themselves more than anything.  Make your efforts truly worthwhile.  If over time there's 20 people we've helped in this fashion...  put 20 links in the .info file!  Some of our users actually READ those .info files before installing!!  SOME.  Not enough...  but some! :)

Take care!


Offline Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11544
Re: Rsyslog not working
« Reply #11 on: October 06, 2024, 11:57:43 PM »
Hi CentralWare
... The config(s) you do choose to enclose, just make sure that with those files, the application(s) start without error and can be tested using those configs.  They may not do what the user wants to do in the end...  but there's no way to know what exactly ...
And that's why some extensions contain  .conf.example  or  .conf.sample
files. I think a  .conf  file with an  .example  or  .sample  extension tacked
on to the end makes it clear it's not meant to be plug and play.

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #12 on: October 07, 2024, 01:28:42 AM »
Andyj,
I actually DID read your example, not copied it blindly, concluded that your "module(load=" directives were essential the same as the "$ModLoad" syntax I'm using.
And you helped me because I noticed you included a "workdirectory" directive I did not have.
So,.. thanks again :).

With that said...
Before even posting here I got my input from a sample at GitHub: https://github.com/rsyslog/rsyslog/blob/master/sample.conf

The big annoying thing....
- Eventually I got it working by adding the global directives on "workdirectory" and/or "imuxsock"
- The sample file however does NOT include them, not mentions them, no information on essential global directives.

So,.. yeah,... it's of coarse open source and depending on the sweat of volunteers. I guess they have focussed on explaining "functionality" and have the "essentials to get it lightened up" a bit undervalued. The whole section on explaining global directives is quite minimal.

(and there is probably an other sample configuration to there that has it, but I used a lot of google and could not find it)

Offline Stefann

  • Jr. Member
  • **
  • Posts: 77
Re: Rsyslog not working
« Reply #13 on: October 12, 2024, 04:29:24 AM »
Bad... rotate script is not working
As far as I can see it's a bug in Rsyslog
Because I see same behaviour as here: https://github.com/rsyslog/rsyslog/issues/4879
==> I however do not see how that got resolved (its just closed without resolution)

I try to rotate the error log by setting an out channel with a file limit and rotate script:
Code: [Select]
$outchannel debug_log,/var/log/errorlog.txt, 1000, /var/log/./rotate_debug

with rotate_debug like below:
tail -n 1 errorlog.txt > error.tmp
mv -f error.tmp errorlog.txt

However: rotate_debug does not get called

Inspird by above bugreport I tried:
Code: [Select]
$outchannel debug_log,/var/log/errorlog.txt, 1000, rm /var/log/errorlog.txtwhich indeed removes the log, but than I have nothing left (I would like to have the old one copied

I tried various alternatives without success:
Code: [Select]
$outchannel debug_log,/var/log/errorlog.txt, 1000, sudo /var/log/rotate_debug
$outchannel debug_log,/var/log/errorlog.txt, 1000, 'sudo /var/log/rotate_debug'
$outchannel debug_log,/var/log/errorlog.txt, 1000, mv /var/log/errorlog.txt /var/log/errorlog.txt.rot

looking into the Rsyslog debugging shows:
Code: [Select]
0384.246797798:main Q:Reg/w0  : srutils.c: exec program ''sudo' /var/log/rotate_debug'
0384.294856440:main Q:Reg/w0  : glbl.c: waitpid for child 9275 returned status: 100
0384.295033916:main Q:Reg/w0  : errmsg.c: Called LogMsg, msg: program ''sudo' (pid 9275) exited with status 1
0384.295074123:main Q:Reg/w0  : operatingstate.c: osf: MSG program ''sudo' (pid 9275) exited with status 1: signaling new internal message via SIGTTOU: 'program ''sudo' (pid 9275) exited with status 1 [v8.2312.0]'
0384.295370296:main Q:Reg/w0  : errmsg.c: Called LogMsg, msg: file size limit cmd for file '/var/log/errorlog.txt' did no resolve situation

0384.295407136:main Q:Reg/w0  : operatingstate.c: osf: MSG file size limit cmd for file '/var/log/errorlog.txt' did no resolve situation

So: it indeed seems to call the script, but execution is not really successful. Rsyslog even identifies that reducing filsize failed



Any ideas???
If I cannot get this to wrok I will divert to an alternative log cleaning method.
Maybe just do a quarterly cron to check filesizes and clean

Offline patrikg

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 702
Re: Rsyslog not working
« Reply #14 on: October 12, 2024, 04:48:55 AM »
Maybe when log rotate, it uses/calls to some library to compress that is not reached.
Check with ldd or even it's static so when configure and compiling you can enable or disable that feature.
Or even escape that space because it launches sudo without any args.
Or try just doing some debugging how that command being executed, and what environment it has.
Just add command id > /tmp/debug.log, to see what user executing.
If you also get that /tmp/debug.log file, if the command being executed with the args.
If that is not the case, you maybe can build a shell script to circumstance that the command is not being executed with any of the args. And then just add that script to your rsyslog conf.

Maybe it not using its correct systemcall, how to pass the args.
man 3 exec
 
« Last Edit: October 12, 2024, 05:16:08 AM by patrikg »