Hi
I have a Raspberry PI 3B+ with Raspbian GNU/Linux 10 (buster) on which I intend to recieve syslog messages twith a specified format and update an MySQL database based on the data sent in the logpost.
So far I have been able to setup Rsyslog (v 8.1901.0-1) to filter these messages and with Omprog module been able to run a MySQL query. So far so good.
But, when I "stress test" it, for some reason the Omprog module does not execute on every log post. When I switch to a normal log file, I see what I expect, but not when using the Omprog module and a bash script.
Here is my Rsyslog configuration:
module(load="omprog")
if $hostname == 'SUS' then {
action(type="omprog" binary="/home/pi/telldusUpdate2.sh")
stop
}
Here is the the telldusUpdate2 script (stripped the original script to ensure the content of it did not cause the problem):
#!/bin/bash
echo "Script was executed" >> /var/log/telldus.log
When I trigger an event that will make 4 logposts, I only see 3 of them in the /var/log/telldus.log.
At the same time in /var/log/syslog, this message comes up (3 times, not 4 as you can see):
Oct 10 13:06:35 raspberrypi rsyslogd: omprog: program '/home/pi/telldusUpdate2.sh' (pid 11199) terminated; will be restarted [v8.1901.0 try https://www.rsyslog.com/e/2119 ]
Oct 10 13:06:35 raspberrypi rsyslogd: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Oct 10 13:06:36 raspberrypi rsyslogd: action 'action-0-omprog' resumed (module 'omprog') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
Oct 10 13:06:39 raspberrypi rsyslogd: omprog: program '/home/pi/telldusUpdate2.sh' (pid 11431) terminated; will be restarted [v8.1901.0 try https://www.rsyslog.com/e/2119 ]
Oct 10 13:06:39 raspberrypi rsyslogd: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Oct 10 13:06:40 raspberrypi rsyslogd: action 'action-0-omprog' resumed (module 'omprog') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
Oct 10 13:06:40 raspberrypi rsyslogd: omprog: program '/home/pi/telldusUpdate2.sh' (pid 11432) terminated; will be restarted [v8.1901.0 try https://www.rsyslog.com/e/2119 ]
Oct 10 13:06:40 raspberrypi rsyslogd: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Oct 10 13:06:41 raspberrypi rsyslogd: action 'action-0-omprog' resumed (module 'omprog') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
I am beginning to be really frustrated. What is causing this issue?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
I have a Raspberry PI 3B+ with Raspbian GNU/Linux 10 (buster) on which I intend to recieve syslog messages twith a specified format and update an MySQL database based on the data sent in the logpost.
So far I have been able to setup Rsyslog (v 8.1901.0-1) to filter these messages and with Omprog module been able to run a MySQL query. So far so good.
But, when I "stress test" it, for some reason the Omprog module does not execute on every log post. When I switch to a normal log file, I see what I expect, but not when using the Omprog module and a bash script.
Here is my Rsyslog configuration:
module(load="omprog")
if $hostname == 'SUS' then {
action(type="omprog" binary="/home/pi/telldusUpdate2.sh")
stop
}
Here is the the telldusUpdate2 script (stripped the original script to ensure the content of it did not cause the problem):
#!/bin/bash
echo "Script was executed" >> /var/log/telldus.log
When I trigger an event that will make 4 logposts, I only see 3 of them in the /var/log/telldus.log.
At the same time in /var/log/syslog, this message comes up (3 times, not 4 as you can see):
Oct 10 13:06:35 raspberrypi rsyslogd: omprog: program '/home/pi/telldusUpdate2.sh' (pid 11199) terminated; will be restarted [v8.1901.0 try https://www.rsyslog.com/e/2119 ]
Oct 10 13:06:35 raspberrypi rsyslogd: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Oct 10 13:06:36 raspberrypi rsyslogd: action 'action-0-omprog' resumed (module 'omprog') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
Oct 10 13:06:39 raspberrypi rsyslogd: omprog: program '/home/pi/telldusUpdate2.sh' (pid 11431) terminated; will be restarted [v8.1901.0 try https://www.rsyslog.com/e/2119 ]
Oct 10 13:06:39 raspberrypi rsyslogd: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Oct 10 13:06:40 raspberrypi rsyslogd: action 'action-0-omprog' resumed (module 'omprog') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
Oct 10 13:06:40 raspberrypi rsyslogd: omprog: program '/home/pi/telldusUpdate2.sh' (pid 11432) terminated; will be restarted [v8.1901.0 try https://www.rsyslog.com/e/2119 ]
Oct 10 13:06:40 raspberrypi rsyslogd: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Oct 10 13:06:41 raspberrypi rsyslogd: action 'action-0-omprog' resumed (module 'omprog') [v8.1901.0 try https://www.rsyslog.com/e/2359 ]
I am beginning to be really frustrated. What is causing this issue?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.