[rsyslog-notify] Forum Thread: dynaFile option failing to Load - (Mode 'post')

noreply at adiscon.com noreply at adiscon.com
Fri Jun 5 21:17:37 CEST 2015


User: snorman1483 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25665#p25665

Message: 
----------
I am attempting to use dynaFile option when I am writing out to a file and
each Time i load the configuration it fails to load my rulesets. Here are
the following error messages.

I am running version 8.9 of rsyslog.

Jun  5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/TCP514.conf, on or before line 4: invalid property
'month' 
Jun  5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/TCP514.conf, on or before line 4: error processing
template object
Jun  5 19:05:58 hostname rsyslogd-3003: Could not find template 1
'stored_logs' - action disabled [v8.9.0 try <!-- m --><a class="postlink"
href="http://www.rsyslog.com/e/3003">http://www.rsyslog.com/e/3003</a><!--
m --> ]
Jun  5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/TCP514.conf, on or before line 28: errors occured in
file '
Jun  5 19:05:58 hostname rsyslogd-3003: Could not find template 1
'stored_logs' - action disabled [v8.9.0 try <!-- m --><a class="postlink"
href="http://www.rsyslog.com/e/3003">http://www.rsyslog.com/e/3003</a><!--
m --> ]
Jun  5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/UDP514.conf, on or before line 26: errors occured in
file '

Here is my configure

template(type="string" name="raw" string="%rawmsg%")
[b:3mzpa1s6]template(name="stored_logs" type="string"
string="/var/log/rsyslog/%month%/%day%/%hostname%.log")[/b:3mzpa1s6]

ruleset(name="TCP514") {

	if $fromhost-ip == "10.10.10.2" then {

		if $rawmsg contains_i "word" then {
			
			action(
				type="omfwd"
				target="10.10.10.23"
				port="514"
				Protocol="TCP"
				Template="raw"
				queue.spoolDirectory="/var/log/rsyslog"
				queue.maxdiskspace="10g"
				action.resumeRetryCount="-1"
				queue.filename="Spooled"
				queue.type="LinkedList"
				queue.saveonshutdown="on"
				queue.maxfilesize="64m"
			)
			[b:3mzpa1s6]action(
				type="omfile"
				dynaFile="stored_logs"
				template="RSYSLOG_SyslogProtocol23Format"
			)[/b:3mzpa1s6]
			stop
        }

		action(
			type="omfwd"
			target="10.10.10.31"
			port="5514"		
			Protocol="tcp"
			Template="RSYSLOG_SyslogProtocol23Format"
			action.resumeRetryCount="-1"
			queue.type="linkedList"
			queue.fileName="LRSpooledLogs"
			queue.maxdiskspace="10g"
			queue.saveonshutdown="on"
			queue.maxfilesize="64m"
		)
	}
}
input(type="imtcp" port="514" ruleset="TCP514")

ruleset(name="UDP514") {

if $fromhost-ip == "10.10.10.2" then {

        if $rawmsg contains_i "word" then {
            
			action(
				type="omfwd"
				target="10.10.10.23"
				port="514"
				Protocol="TCP"
				Template="raw"
				queue.spoolDirectory="/var/log/rsyslog"
				queue.maxdiskspace="10g"
				action.resumeRetryCount="-1"
				queue.filename="Spooled"
				queue.type="LinkedList"
				queue.saveonshutdown="on"
				queue.maxfilesize="64m"
			)
        
			[b:3mzpa1s6] action(
				type="omfile"
				dynaFile="stored_logs"
				template="RSYSLOG_SyslogProtocol23Format"
			)[/b:3mzpa1s6]
			stop
		}

        action(
                type="omfwd"
                target="10.10.10..31"
                port="5514"
                Protocol="TCP"
                queue.spoolDirectory="/var/log/rsyslog"
                action.resumeRetryCount="-1"
                queue.type="LinkedList"
                queue.fileName="LRSpooledLogs"
                queue.maxdiskspace="10g"
                queue.saveonshutdown="on"
                queue.maxfilesize="64m"
                template="raw"
        )
	}
}
input(type="imudp" port="514" ruleset="UDP514")


More information about the rsyslog-notify mailing list