Mailing List Archive

Multiple imux sockets?
I am doing remote logging with relp for all my log files, but I want to
write *one* log file locally, I thought I could just bind a new imuxsock
to the syslog socket input to a ruleset and that would work, but I'm
getting inconsistent results where some logs make it locally and some
not, but the rest do manage to make it remotely.

My configuration is fairly simple, but something must not be right, can
someone suggest a fix for this?

In /etc/rsyslog.conf, I have:

global(
maxMessageSize="64k"
)

module(load="imuxsock"
SysSock.Use="off"
)

module(load="imkmsg")

module(
load="omprog"
)

module(
load="omrelp"
tls.tlslib="openssl"
)

$DefaultRuleset incoming

input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="incoming")

$IncludeConfig /etc/rsyslog.d/*.conf


and then in /etc/rsyslog.d/00_client.conf I have:

ruleset(name="incoming") {
# Send remote
action(type="omrelp"
target="woodpecker-pn.riseup.net"
port="6515"
tls="on"
tls.compression="on"
tls.authmode="certvalid"
tls.permittedpeer="woodpecker.riseup.net"
tls.cacert="/etc/certs/roots/riseup.pem"
tls.mycert="/etc/certs/client/certs/etherpadlite.riseup.net/etherpadlite.riseup.net_server.crt"
tls.myprivkey="/etc/certs/client/keys/etherpadlite.riseup.net/etherpadlite.riseup.net_server.key"
action.resumeRetryCount="-1"
action.resumeInterval="2"
action.reportSuspension="on"
queue.workerthreads="4"
queue.size="50000"
queue.spoolDirectory="/var/spool/rsyslog"
queue.filename="remote"
queue.maxfilesize="64m"
queue.maxdiskspace="2g"
queue.type="LinkedList"
queue.saveonshutdown="on"
)
}

and in /etc/rsyslog.d/etherpad-lite.conf, I have:

ruleset(name="etherpad") {
if $programname == "etherpad-lite" then {
/var/log/etherpad-lite/etherpad-lite.log
}
}

input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="etherpad")
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Multiple imux sockets? [ In reply to ]
you are thinking that it matters what file a configuration stanza is in. It
doesn't. run rsyslogd -o /path/to/file and rsyslog will create a single file
that is what it sees as the config after combining all the files.

right off the bat, it looks like you have two input stanzas looking at the same
socket path, that isn't going to work.

David Lang

On Thu, 5 May
2022, micah anderson via rsyslog wrote:

> Date: Thu, 05 May 2022 11:54:42 -0400
> From: micah anderson via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: micah anderson <micah@riseup.net>
> Subject: [rsyslog] Multiple imux sockets?
>
>
> I am doing remote logging with relp for all my log files, but I want to
> write *one* log file locally, I thought I could just bind a new imuxsock
> to the syslog socket input to a ruleset and that would work, but I'm
> getting inconsistent results where some logs make it locally and some
> not, but the rest do manage to make it remotely.
>
> My configuration is fairly simple, but something must not be right, can
> someone suggest a fix for this?
>
> In /etc/rsyslog.conf, I have:
>
> global(
> maxMessageSize="64k"
> )
>
> module(load="imuxsock"
> SysSock.Use="off"
> )
>
> module(load="imkmsg")
>
> module(
> load="omprog"
> )
>
> module(
> load="omrelp"
> tls.tlslib="openssl"
> )
>
> $DefaultRuleset incoming
>
> input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="incoming")
>
> $IncludeConfig /etc/rsyslog.d/*.conf
>
>
> and then in /etc/rsyslog.d/00_client.conf I have:
>
> ruleset(name="incoming") {
> # Send remote
> action(type="omrelp"
> target="woodpecker-pn.riseup.net"
> port="6515"
> tls="on"
> tls.compression="on"
> tls.authmode="certvalid"
> tls.permittedpeer="woodpecker.riseup.net"
> tls.cacert="/etc/certs/roots/riseup.pem"
> tls.mycert="/etc/certs/client/certs/etherpadlite.riseup.net/etherpadlite.riseup.net_server.crt"
> tls.myprivkey="/etc/certs/client/keys/etherpadlite.riseup.net/etherpadlite.riseup.net_server.key"
> action.resumeRetryCount="-1"
> action.resumeInterval="2"
> action.reportSuspension="on"
> queue.workerthreads="4"
> queue.size="50000"
> queue.spoolDirectory="/var/spool/rsyslog"
> queue.filename="remote"
> queue.maxfilesize="64m"
> queue.maxdiskspace="2g"
> queue.type="LinkedList"
> queue.saveonshutdown="on"
> )
> }
>
> and in /etc/rsyslog.d/etherpad-lite.conf, I have:
>
> ruleset(name="etherpad") {
> if $programname == "etherpad-lite" then {
> /var/log/etherpad-lite/etherpad-lite.log
> }
> }
>
> input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="etherpad")
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.