I am using rsyslg 8.2004.0-0adiscon1bionic1 from adiscon repository, when
I check the configuration, there's an error
# rsyslogd -f/etc/rsyslog.conf -N1
>
rsyslogd: version 8.2004.0, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
>
The problem is that I look for this maxLinesAtOnce in the whole
configuration under /etc/ and I can't find it. The config file that started
the issue is this one (slightly adapted from an example on internet)
$PrivDropToGroup adm
> $WorkDirectory /var/spool/rsyslog
>
> # Nginx access file:
> $InputFileName /var/log/nginx/access.log
> $InputFileTag nginx-access:
> $InputFileStateFile stat-nginx-access
> $InputFileSeverity info
> $InputFilePersistStateInterval 20000
> $InputRunFileMonitor
>
> #Nginx Error file:
> $InputFileName /var/log/nginx/error.log
> $InputFileTag nginx-error:
> $InputFileStateFile stat-nginx-error
> $InputFileSeverity error
> $InputFilePersistStateInterval 20000
> $InputRunFileMonitor
>
> #Add a tag for nginx events
> $template LogglyFormatNginx,"<%pri%>%protocol-version%
> %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid%
> [TOKEN@41058 tag=\"nginx\"] %msg%\n"
>
> if $programname == 'nginx-access' then @@graylog.example.com:514
> ;RSYSLOG_SyslogProtocol23Format
> if $programname == 'nginx-access' then ~
> if $programname == 'nginx-error' then @@graylog.example.com:514
> ;RSYSLOG_SyslogProtocol23Format
> if $programname == 'nginx-error' then ~
>
Where should I look for this maxLinesAtOnce setting?
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
I check the configuration, there's an error
# rsyslogd -f/etc/rsyslog.conf -N1
>
rsyslogd: version 8.2004.0, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
> rsyslogd: parameter "maxLinesAtOnce" not permited in inotify mode -
> ignored [v8.2004.0 try https://www.rsyslog.com/e/2222 ]
>
The problem is that I look for this maxLinesAtOnce in the whole
configuration under /etc/ and I can't find it. The config file that started
the issue is this one (slightly adapted from an example on internet)
$PrivDropToGroup adm
> $WorkDirectory /var/spool/rsyslog
>
> # Nginx access file:
> $InputFileName /var/log/nginx/access.log
> $InputFileTag nginx-access:
> $InputFileStateFile stat-nginx-access
> $InputFileSeverity info
> $InputFilePersistStateInterval 20000
> $InputRunFileMonitor
>
> #Nginx Error file:
> $InputFileName /var/log/nginx/error.log
> $InputFileTag nginx-error:
> $InputFileStateFile stat-nginx-error
> $InputFileSeverity error
> $InputFilePersistStateInterval 20000
> $InputRunFileMonitor
>
> #Add a tag for nginx events
> $template LogglyFormatNginx,"<%pri%>%protocol-version%
> %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid%
> [TOKEN@41058 tag=\"nginx\"] %msg%\n"
>
> if $programname == 'nginx-access' then @@graylog.example.com:514
> ;RSYSLOG_SyslogProtocol23Format
> if $programname == 'nginx-access' then ~
> if $programname == 'nginx-error' then @@graylog.example.com:514
> ;RSYSLOG_SyslogProtocol23Format
> if $programname == 'nginx-error' then ~
>
Where should I look for this maxLinesAtOnce setting?
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.