[rsyslog-notify] Forum Thread: how to use mmsequence module send log to another host - (Mode 'post')

[noreply at adiscon.com]

User: lee62817 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25658#p25658

Message: 
----------
i want to use mmsequence module send log to another host
but mmsequence not work

os centos7 X64

[root at localhost ~]# rsyslogd -v
rsyslogd 7.6.7, compiled with:
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

my rsyslog.conf

$template insertpl,"insert into SystemEvents (Message, Facility, FromHost,
FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)
values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%',
%syslogpriority%, '%timereported:::date-mysql%',
'%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL
#### MODULES ####
$ModLoad ommysql
*.*:ommysql:localhost,Syslog,rsyslog,XXXXXXX;insertpl
# The imjournal module bellow is now used as a message source instead of
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability
$ModLoad immark
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
#$ModLoad mmsequence
#$ModLoad omfwd

Ruleset( name="forwardRuleSet" ) {
    Action ( type="mmsequence" mode="instance" from="0" to="4" var="$.seq"
)
    if $.seq == "0" then {
        action  (type="omfwd" Target="10.5.1.111" Port="5511"
Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )
    }
    if $.seq == "1" then {
        action  (type="omfwd" Target="10.5.1.111" Port="5512"
Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )
    }
    if $.seq == "2" then {
        action  (type="omfwd" Target="10.5.1.111" Port="5513"
Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )
    }
    if $.seq == "3" then {
        action  (type="omfwd" Target="10.5.1.111" Port="5514"
Protocol="tcp" queue.size="150000" queue.dequeuebatchsize="2000" )
    }
}

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
#cron.*                                                  /var/log/cron

# Everybody gets emergency messages
#*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.i1:514, port optional
#*.* @@remote-host:514

logstash.conf

input {
  tcp {     port => "5511"    type => "syslog" ruleset="forwardRuleSet"}
  tcp {     port => "5512"    type => "syslog" ruleset="forwardRuleSet"}
  tcp {     port => "5513"    type => "syslog" ruleset="forwardRuleSet"}
  tcp {     port => "5514"    type => "syslog" ruleset="forwardRuleSet"}

}

filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp}
%{SYSLOGHOST:syslog_hostname}
%{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?:
%{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}

output {
redis {
                host => "localhost"
                data_type => "list"
                key => "logstash"
        }
}

i use rsyslog -n got error messang

[root at localhost ~]# rsyslogd -n
rsyslogd: could not load module '/lib64/rsyslog/imjournal.so', dlopen:
/lib64/rsyslog/imjournal.so: cannot open shared object file: No such file
or directory  [try <!-- m --><a class="postlink"
href="http://www.rsyslog.com/e/2066">http://www.rsyslog.com/e/2066</a><!--
m --> ]
rsyslogd: module name 'mmsequence' is unknown [try <!-- m --><a
class="postlink"
href="http://www.rsyslog.com/e/2209">http://www.rsyslog.com/e/2209</a><!--
m --> ]
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line
27: errors occured in file '/etc/rsyslog.conf' around line 27 [try <!-- m
--><a class="postlink"
href="http://www.rsyslog.com/e/2207">http://www.rsyslog.com/e/2207</a><!--
m --> ]
rsyslogd: pidfile '/var/run/rsyslogd.pid' and pid 28977 already exist.

how can i fix  this error   (rsyslogd: module name 'mmsequence' is unknown)
please help me 

tks!