[rsyslog-notify] Forum Thread: Re: odd behavour of rsyslogd -N1 - (Mode 'reply')

[noreply at adiscon.com]

User: atticus 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26767#p26767

Message: 
----------
Thank you for the response.  I looked deeper into the etc/rsyslog.conf file
and  it includes this statement
$IncludeConfig /etc/rsyslog.d/*.conf

So 1)  Am I right in thinking /sbin/rsyslogd  is calling my
/etc/rsyslog.conf, plus etc/rsyslog.d/rsyslog.conf

2)  When I attempt to do an /etc/rsyslogd -N1 now with the original SuSe
/etc/rsyslog.conf (this was working with the includes yesterday)  I get
something like:
 
linux:/etc # rsyslogd -N1

linux:/etc # rsyslogd -N1 -f /etc/rsyslog.conf
rsyslogd: version 8.4.0, config validation run (level 1), master config
/etc/rsyslog.conf
rsyslogd: module 'imudp' already in this config, cannot be added  [try
rsyslog.com/e/2221 ]
rsyslogd: module 'imtcp' already in this config, cannot be added  [try 
rsyslog.com/e/2221 ]
rsyslogd: error: ruleset 'fwdlocal' specified more than once [try 
rsyslog.com/e/2306 ]
rsyslogd: error: ruleset 'fwd1' specified more than once [try 
rsyslog.com/e/2306 ]
rsyslogd: error during parsing file /etc/rsyslog.d/nbnco.windows.conf, on
or before line 121: parameter 'queue.MaxDiskSpace' not known -- typo in
config file? [try  rsyslog.com/e/2207 ]
rsyslogd: error during parsing file /etc/rsyslog.d/nbnco.windows.conf, on
or before line 121: parameter 'queue.saveonshutdown' not known -- typo in
config file? [try  rsyslog.com/e/2207 ]

Notice how the module loads are duplicate (they are in the
etc/rsyslog.d/rsyslog.conf, but the rulesets are in the
/etc/rsyslog.d/rsyslog.conf

So
when you say "main" rsyslog.conf, do you mean in the /etc/rsyslog.conf?  So
I think I'm troubleshooting then the main file /etc/rsyslog.conf plus the
include on the /etc/rsyslog.d/rsyslog.conf  Is that correct?  I need to
rsyslogd -N2 on the /etc/rsyslog.conf (that's the default anyway,
right?)work may way through any of the /etc/rsyslog.conf and any of its
includes?  Or could I just replace the original SuSE /etc/rsyslog.conf or
even just edit what looks to be the duplicates between the main and the
include?

I'm pretty confused here so I very much appreciate your help.

Best regards, 

Atticus