[rsyslog-notify] Forum Thread: rsyslog error ! - (Mode 'edit_topic')

noreply at adiscon.com noreply at adiscon.com
Thu May 14 03:24:03 CEST 2015


User: lee62817 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25601#p25601

Message: 
----------
my rsylog do not  send log to loganalyzer today

i restart rsyslog service  and got error at loanalyzer


[img:3285st1y]http://i62.photobucket.com/albums/h118/lee62817/error1_zpswsl7hzgz.jpg[/img:3285st1y]


[img:3285st1y]http://i62.photobucket.com/albums/h118/lee62817/error2_zpscyirxefc.jpg[/img:3285st1y]


[img:3285st1y]http://i62.photobucket.com/albums/h118/lee62817/error3_zpsstx41rq1.jpg[/img:3285st1y]


my os:centos 7
rsyslogd -version
rsyslogd 7.6.7, compiled with:
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

my rsyslog.conf

$template insertpl,"insert into SystemEvents (Message, Facility, FromHost,
FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)
values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%',
%syslogpriority%, '%timereported:::date-mysql%',
'%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL

$template stdmsg,"%timereported% %hostname% %fromhost-ip%
%syslogtag%%$!msg:::sp-if-no-1st-sp%%msg%\n"

#### MODULES ####
$ModLoad ommysql
*.*:ommysql:localhost,Syslog,rsyslog,xxxxxxxxxxx;insertpl
# The imjournal module bellow is now used as a message source instead of
imuxsock.
$ModLoad imuxsock
$ModLoad imjournal
$ModLoad immark
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad omfwd
*.* @@10.5.1.111:5514;stdmsg
#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


how can i enable debug mode  and fix the error


please help me

tks!


More information about the rsyslog-notify mailing list