[rsyslog-notify] Forum Thread: dynaFile option failing to Load - (Mode 'post')
noreply at adiscon.com
noreply at adiscon.com
Fri Jun 5 21:17:37 CEST 2015
User: snorman1483
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25665#p25665
Message:
----------
I am attempting to use dynaFile option when I am writing out to a file and
each Time i load the configuration it fails to load my rulesets. Here are
the following error messages.
I am running version 8.9 of rsyslog.
Jun 5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/TCP514.conf, on or before line 4: invalid property
'month'
Jun 5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/TCP514.conf, on or before line 4: error processing
template object
Jun 5 19:05:58 hostname rsyslogd-3003: Could not find template 1
'stored_logs' - action disabled [v8.9.0 try <!-- m --><a class="postlink"
href="http://www.rsyslog.com/e/3003">http://www.rsyslog.com/e/3003</a><!--
m --> ]
Jun 5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/TCP514.conf, on or before line 28: errors occured in
file '
Jun 5 19:05:58 hostname rsyslogd-3003: Could not find template 1
'stored_logs' - action disabled [v8.9.0 try <!-- m --><a class="postlink"
href="http://www.rsyslog.com/e/3003">http://www.rsyslog.com/e/3003</a><!--
m --> ]
Jun 5 19:05:58 hostname rsyslogd-2207: error during parsing file
/etc/rsyslog.d/msp/UDP514.conf, on or before line 26: errors occured in
file '
Here is my configure
template(type="string" name="raw" string="%rawmsg%")
[b:3mzpa1s6]template(name="stored_logs" type="string"
string="/var/log/rsyslog/%month%/%day%/%hostname%.log")[/b:3mzpa1s6]
ruleset(name="TCP514") {
if $fromhost-ip == "10.10.10.2" then {
if $rawmsg contains_i "word" then {
action(
type="omfwd"
target="10.10.10.23"
port="514"
Protocol="TCP"
Template="raw"
queue.spoolDirectory="/var/log/rsyslog"
queue.maxdiskspace="10g"
action.resumeRetryCount="-1"
queue.filename="Spooled"
queue.type="LinkedList"
queue.saveonshutdown="on"
queue.maxfilesize="64m"
)
[b:3mzpa1s6]action(
type="omfile"
dynaFile="stored_logs"
template="RSYSLOG_SyslogProtocol23Format"
)[/b:3mzpa1s6]
stop
}
action(
type="omfwd"
target="10.10.10.31"
port="5514"
Protocol="tcp"
Template="RSYSLOG_SyslogProtocol23Format"
action.resumeRetryCount="-1"
queue.type="linkedList"
queue.fileName="LRSpooledLogs"
queue.maxdiskspace="10g"
queue.saveonshutdown="on"
queue.maxfilesize="64m"
)
}
}
input(type="imtcp" port="514" ruleset="TCP514")
ruleset(name="UDP514") {
if $fromhost-ip == "10.10.10.2" then {
if $rawmsg contains_i "word" then {
action(
type="omfwd"
target="10.10.10.23"
port="514"
Protocol="TCP"
Template="raw"
queue.spoolDirectory="/var/log/rsyslog"
queue.maxdiskspace="10g"
action.resumeRetryCount="-1"
queue.filename="Spooled"
queue.type="LinkedList"
queue.saveonshutdown="on"
queue.maxfilesize="64m"
)
[b:3mzpa1s6] action(
type="omfile"
dynaFile="stored_logs"
template="RSYSLOG_SyslogProtocol23Format"
)[/b:3mzpa1s6]
stop
}
action(
type="omfwd"
target="10.10.10..31"
port="5514"
Protocol="TCP"
queue.spoolDirectory="/var/log/rsyslog"
action.resumeRetryCount="-1"
queue.type="LinkedList"
queue.fileName="LRSpooledLogs"
queue.maxdiskspace="10g"
queue.saveonshutdown="on"
queue.maxfilesize="64m"
template="raw"
)
}
}
input(type="imudp" port="514" ruleset="UDP514")
More information about the rsyslog-notify
mailing list