Mailing List Archive: Rsyslog check complaining from maxLinesAtOnce not present on configs

Rsyslog check complaining from maxLinesAtOnce not present on configs

May 27, 2020, 7:26 AM

Post #1 of 3 (486 views)

I am using rsyslg 8.2004.0-0adiscon1bionic1 from adiscon repository, when
I check the configuration, there's an error

# rsyslogd -f/etc/rsyslog.conf -N1
>
rsyslogd: version 8.2004.0, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
>

The problem is that I look for this maxLinesAtOnce in the whole
configuration under /etc/ and I can't find it. The config file that started
the issue is this one (slightly adapted from an example on internet)

$PrivDropToGroup adm
> $WorkDirectory /var/spool/rsyslog
>
> # Nginx access file:
> $InputFileName /var/log/nginx/access.log
> $InputFileTag nginx-access:
> $InputFileStateFile stat-nginx-access
> $InputFileSeverity info
> $InputFilePersistStateInterval 20000
> $InputRunFileMonitor
>
> #Nginx Error file:
> $InputFileName /var/log/nginx/error.log
> $InputFileTag nginx-error:
> $InputFileStateFile stat-nginx-error
> $InputFileSeverity error
> $InputFilePersistStateInterval 20000
> $InputRunFileMonitor
>
> #Add a tag for nginx events
> $template LogglyFormatNginx,"<%pri%>%protocol-version%
> %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid%
> [TOKEN@41058 tag=\"nginx\"] %msg%\n"
>
> if $programname == 'nginx-access' then @@graylog.example.com:514
> ;RSYSLOG_SyslogProtocol23Format
> if $programname == 'nginx-access' then ~
> if $programname == 'nginx-error' then @@graylog.example.com:514
> ;RSYSLOG_SyslogProtocol23Format
> if $programname == 'nginx-error' then ~
>

Where should I look for this maxLinesAtOnce setting?
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Rsyslog check complaining from maxLinesAtOnce not present on configs [ In reply to ]

rsyslog at lists

May 30, 2020, 10:53 AM

Post #2 of 3 (483 views)

Permalink

create a combined config file by starting rsyslog with the -o flag
something like -o /etc/rsyslog.conf.generated

then look at that combined file to see where it's set. If you can't find
anything, post the generated file here.

David Lang

On Wed, 27 May 2020, Joan via rsyslog wrote:

> Date: Wed, 27 May 2020 16:26:00 +0200
> From: Joan via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog-users <rsyslog@lists.adiscon.com>
> Cc: Joan <aseques@gmail.com>
> Subject: [rsyslog] Rsyslog check complaining from maxLinesAtOnce not present
> on configs
>
> I am using rsyslg 8.2004.0-0adiscon1bionic1 from adiscon repository, when
> I check the configuration, there's an error
>
> # rsyslogd -f/etc/rsyslog.conf -N1
>>
> rsyslogd: version 8.2004.0, config validation run (level 1), master config
>> /etc/rsyslog.conf
>> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
>> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
>> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
>> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
>>
>
> The problem is that I look for this maxLinesAtOnce in the whole
> configuration under /etc/ and I can't find it. The config file that started
> the issue is this one (slightly adapted from an example on internet)
>
> $PrivDropToGroup adm
>> $WorkDirectory /var/spool/rsyslog
>>
>> # Nginx access file:
>> $InputFileName /var/log/nginx/access.log
>> $InputFileTag nginx-access:
>> $InputFileStateFile stat-nginx-access
>> $InputFileSeverity info
>> $InputFilePersistStateInterval 20000
>> $InputRunFileMonitor
>>
>> #Nginx Error file:
>> $InputFileName /var/log/nginx/error.log
>> $InputFileTag nginx-error:
>> $InputFileStateFile stat-nginx-error
>> $InputFileSeverity error
>> $InputFilePersistStateInterval 20000
>> $InputRunFileMonitor
>>
>> #Add a tag for nginx events
>> $template LogglyFormatNginx,"<%pri%>%protocol-version%
>> %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid%
>> [TOKEN@41058 tag=\"nginx\"] %msg%\n"
>>
>> if $programname == 'nginx-access' then @@graylog.example.com:514
>> ;RSYSLOG_SyslogProtocol23Format
>> if $programname == 'nginx-access' then ~
>> if $programname == 'nginx-error' then @@graylog.example.com:514
>> ;RSYSLOG_SyslogProtocol23Format
>> if $programname == 'nginx-error' then ~
>>
>
> Where should I look for this maxLinesAtOnce setting?
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Rsyslog check complaining from maxLinesAtOnce not present on configs [ In reply to ]

rsyslog at lists

Sep 1, 2020, 12:46 AM

Post #3 of 3 (463 views)

Permalink

Hello, I totally forgot about this until I checked my archive again, and
the issue is still present, as you suggested I dumped the configuration and
attached it to this email.
Rsyslog is 8.2002.0 from adiscon repos installed on a 18.04 system.

Missatge de David Lang <david@lang.hm> del dia ds., 30 de maig 2020 a les
19:53:

> create a combined config file by starting rsyslog with the -o flag
> something like -o /etc/rsyslog.conf.generated
>
> then look at that combined file to see where it's set. If you can't find
> anything, post the generated file here.
>
> David Lang
>
> On Wed, 27 May 2020, Joan via rsyslog wrote:
>
> > Date: Wed, 27 May 2020 16:26:00 +0200
> > From: Joan via rsyslog <rsyslog@lists.adiscon.com>
> > To: rsyslog-users <rsyslog@lists.adiscon.com>
> > Cc: Joan <aseques@gmail.com>
> > Subject: [rsyslog] Rsyslog check complaining from maxLinesAtOnce not
> present
> > on configs
> >
> > I am using rsyslg 8.2004.0-0adiscon1bionic1 from adiscon repository,
> when
> > I check the configuration, there's an error
> >
> > # rsyslogd -f/etc/rsyslog.conf -N1
> >>
> > rsyslogd: version 8.2004.0, config validation run (level 1), master
> config
> >> /etc/rsyslog.conf
> >> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> >> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
> >> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> >> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
> >>
> >
> > The problem is that I look for this maxLinesAtOnce in the whole
> > configuration under /etc/ and I can't find it. The config file that
> started
> > the issue is this one (slightly adapted from an example on internet)
> >
> > $PrivDropToGroup adm
> >> $WorkDirectory /var/spool/rsyslog
> >>
> >> # Nginx access file:
> >> $InputFileName /var/log/nginx/access.log
> >> $InputFileTag nginx-access:
> >> $InputFileStateFile stat-nginx-access
> >> $InputFileSeverity info
> >> $InputFilePersistStateInterval 20000
> >> $InputRunFileMonitor
> >>
> >> #Nginx Error file:
> >> $InputFileName /var/log/nginx/error.log
> >> $InputFileTag nginx-error:
> >> $InputFileStateFile stat-nginx-error
> >> $InputFileSeverity error
> >> $InputFilePersistStateInterval 20000
> >> $InputRunFileMonitor
> >>
> >> #Add a tag for nginx events
> >> $template LogglyFormatNginx,"<%pri%>%protocol-version%
> >> %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid%
> >> [TOKEN@41058 tag=\"nginx\"] %msg%\n"
> >>
> >> if $programname == 'nginx-access' then @@graylog.example.com:514
> >> ;RSYSLOG_SyslogProtocol23Format
> >> if $programname == 'nginx-access' then ~
> >> if $programname == 'nginx-error' then @@graylog.example.com:514
> >> ;RSYSLOG_SyslogProtocol23Format
> >> if $programname == 'nginx-error' then ~
> >>
> >
> > Where should I look for this maxLinesAtOnce setting?
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
> >
>

Mailing List Archive

Mailing List Archive

Attached Files: