Mailing List Archive

Error with omfile and queue.filename syntax?
I?m getting the following error trying to test using Disk-Assisted in memory queues. So the error is:

root@splunk:/var/spool/rsyslog# rsyslogd -N1
rsyslogd: version 8.2112.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: error during parsing file /etc/rsyslog.d/10-remote-syslog.conf, on or before line 76: syntax error on token '" queue.fileName=?vcenter.log? queue.workerThreads=' [v8.2112.0 try https://www.rsyslog.com/e/2207 ]
rsyslogd: could not interpret master config file '/etc/rsyslog.conf'. [v8.2112.0 try https://www.rsyslog.com/e/2207 ]


Relevant *.conf lines 72 ? 79 below:

ruleset(name="esxi20524" queue.type="linkedlist" queue.workerThreads="4" queue.workerThreadMinimumMessages="20000"){
action(type="omfile" file="/var/log/remote-syslog/esxi.log" ioBufferSize="64k" flushOnTXEnd="off" asyncWriting="on")
}

ruleset(name="vcenter20525? queue.type="linkedlist" queue.fileName=?vcenter.queue? queue.workerThreads="4" queue.workerThreadMinimumMessages="20000"){
action(type="omfile" FileCreateMode=?0644? fileOwner=?syslog? fileGroup=?adm? file="/var/log/remote-syslog/vcenter.log" ioBufferSize="64k" flushOnTXEnd="off" asyncWriting="on")
}

I am testing both DA, as well as the FileCrearteMode/Owner/Group properties as well. Anyway for queue.fileName I have tried ?file?, ?file.ext? neither work. Unless I?m employing DA wrong from the beginning.
I just read on an archived mailing list thread, about how it?s pretty silly to use disk.queues with omfile, maybe that?s my problem all along?



[Jamf]


Ben Hart
IT Systems Administrator II
100 Washington Ave S, Minneapolis, MN 55401
[Phone]
+00 1 989 424 0187
[Email]
ben.hart@jamf.com
[Web]
www.jamf.com<https://www.jamf.com>
[Facebook] [Twitter] [LinkedIn] [YouTube]
Re: Error with omfile and queue.filename syntax? [ In reply to ]
```
00000000: 7479 7065 3d22 6f6d 6669 6c65 2220 4669 type="omfile" Fi
00000010: 6c65 4372 6561 7465 4d6f 6465 3de2 809c leCreateMode=...
00000020: 3036 3434 e280 9d0a 0644....
```

seem to me like unicode quotes are used instead of ascii ones

bodik


On 8/29/22 9:25 PM, Ben Hart via rsyslog wrote:
> I?m getting the following error trying to test using Disk-Assisted in memory queues. So the error is:
>
> root@splunk:/var/spool/rsyslog# rsyslogd -N1
> rsyslogd: version 8.2112.0, config validation run (level 1), master config /etc/rsyslog.conf
> rsyslogd: error during parsing file /etc/rsyslog.d/10-remote-syslog.conf, on or before line 76: syntax error on token '" queue.fileName=?vcenter.log? queue.workerThreads=' [v8.2112.0 try https://www.rsyslog.com/e/2207 ]
> rsyslogd: could not interpret master config file '/etc/rsyslog.conf'. [v8.2112.0 try https://www.rsyslog.com/e/2207 ]
>
>
> Relevant *.conf lines 72 ? 79 below:
>
> ruleset(name="esxi20524" queue.type="linkedlist" queue.workerThreads="4" queue.workerThreadMinimumMessages="20000"){
> action(type="omfile" file="/var/log/remote-syslog/esxi.log" ioBufferSize="64k" flushOnTXEnd="off" asyncWriting="on")
> }
>
> ruleset(name="vcenter20525? queue.type="linkedlist" queue.fileName=?vcenter.queue? queue.workerThreads="4" queue.workerThreadMinimumMessages="20000"){
> action(type="omfile" FileCreateMode=?0644? fileOwner=?syslog? fileGroup=?adm? file="/var/log/remote-syslog/vcenter.log" ioBufferSize="64k" flushOnTXEnd="off" asyncWriting="on")
> }
>
> I am testing both DA, as well as the FileCrearteMode/Owner/Group properties as well. Anyway for queue.fileName I have tried ?file?, ?file.ext? neither work. Unless I?m employing DA wrong from the beginning.
> I just read on an archived mailing list thread, about how it?s pretty silly to use disk.queues with omfile, maybe that?s my problem all along?
>
>
>
> [Jamf]
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
that sort of error typically means that somewhere prior to this line there are
mismatched quotes, sometimes far before.

David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
Yup, encountered that problem before which is why I included what I hoped would be enough char/lines before the indicated one. I?ve stared at this in Nano so long I?m going cross-eyed.
I don?t have anyone else who knows the format to even ask for their eyes..

From: David Lang <david@lang.hm>
Date: Monday, August 29, 2022 at 3:37 PM
To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
Cc: Ben Hart <ben.hart@jamf.com>
Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
that sort of error typically means that somewhere prior to this line there are
mismatched quotes, sometimes far before.

David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
when I have this problem, I just start at the beginning, search for double
quotes and step through the entire file (don't forget included files) and then I
do it again for single quotes.

I've had the actual error be 20+ lines earlier than the first reported issue.

David Lang

On Mon, 29 Aug 2022, Ben Hart wrote:

> Yup, encountered that problem before which is why I included what I hoped would be enough char/lines before the indicated one. I?ve stared at this in Nano so long I?m going cross-eyed.
> I don?t have anyone else who knows the format to even ask for their eyes..
>
> From: David Lang <david@lang.hm>
> Date: Monday, August 29, 2022 at 3:37 PM
> To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
> Cc: Ben Hart <ben.hart@jamf.com>
> Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
> that sort of error typically means that somewhere prior to this line there are
> mismatched quotes, sometimes far before.
>
> David Lang
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
Generally we don’t use disk queues for omfile destinations.

Then, make sure you didn’t get “Microsofted” by curly quotes as opposed to straight quotes. Can’t tell you how many times an M$ text editor has effed-up a copied configuration by “prettying” up the quotes and dashes.

Regards,

> On Aug 29, 2022, at 14:39, Ben Hart via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> Yup, encountered that problem before which is why I included what I hoped would be enough char/lines before the indicated one. I’ve stared at this in Nano so long I’m going cross-eyed.
> I don’t have anyone else who knows the format to even ask for their eyes..
>
> From: David Lang <david@lang.hm>
> Date: Monday, August 29, 2022 at 3:37 PM
> To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
> Cc: Ben Hart <ben.hart@jamf.com>
> Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
> that sort of error typically means that somewhere prior to this line there are
> mismatched quotes, sometimes far before.
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
I’ve never had one (that I’ve found) quite that far ahead but good to know. So why is it like this? Is there no way to programmatically lint these files?

*I think my issue earlier, and from yesterday were related to copy/paste from outside applications. *sigh* I knew better than that.. I swear!

From: David Lang <david@lang.hm>
Date: Monday, August 29, 2022 at 3:45 PM
To: Ben Hart <ben.hart@jamf.com>
Cc: David Lang <david@lang.hm>, Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
when I have this problem, I just start at the beginning, search for double
quotes and step through the entire file (don't forget included files) and then I
do it again for single quotes.

I've had the actual error be 20+ lines earlier than the first reported issue.

David Lang

On Mon, 29 Aug 2022, Ben Hart wrote:

> Yup, encountered that problem before which is why I included what I hoped would be enough char/lines before the indicated one. I?ve stared at this in Nano so long I?m going cross-eyed.
> I don?t have anyone else who knows the format to even ask for their eyes..
>
> From: David Lang <david@lang.hm>
> Date: Monday, August 29, 2022 at 3:37 PM
> To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
> Cc: Ben Hart <ben.hart@jamf.com>
> Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
> that sort of error typically means that somewhere prior to this line there are
> mismatched quotes, sometimes far before.
>
> David Lang
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
MacOS’s “Notes” app, but yeah, I did. ?

From: John Chivian <jchivian@chivian.com>
Date: Monday, August 29, 2022 at 3:48 PM
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: David Lang <david@lang.hm>, Ben Hart <ben.hart@jamf.com>
Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
Generally we don’t use disk queues for omfile destinations.

Then, make sure you didn’t get “Microsofted” by curly quotes as opposed to straight quotes. Can’t tell you how many times an M$ text editor has effed-up a copied configuration by “prettying” up the quotes and dashes.

Regards,

> On Aug 29, 2022, at 14:39, Ben Hart via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> Yup, encountered that problem before which is why I included what I hoped would be enough char/lines before the indicated one. I’ve stared at this in Nano so long I’m going cross-eyed.
> I don’t have anyone else who knows the format to even ask for their eyes..
>
> From: David Lang <david@lang.hm>
> Date: Monday, August 29, 2022 at 3:37 PM
> To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
> Cc: Ben Hart <ben.hart@jamf.com>
> Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
> that sort of error typically means that somewhere prior to this line there are
> mismatched quotes, sometimes far before.
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
by the way, async writes on omfile are almost never a good idea, it adds an
extra queue between the omfile module and the write, and the locking on that
queue adds more overhead than the write would. The place it has some use is
where your output has a significant amount of processing (compressed output for
example), and even then you have to check.

not the issue you are posting about, but something I noticed in the config.

David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
I've seen cases where run-on quotes or braces have fooled the parser quite
badly.

also, you should be aware that if you start rsyslog with rsyslogd -o
/path/to/file then file will contain the result of all the includes (i.e. the
way that rsyslog sees the configs) which can be very helpful in troubleshooting
cases where it's not doing what you expect.

David Lang


On Mon, 29 Aug 2022, Ben Hart wrote:

> I’ve never had one (that I’ve found) quite that far ahead but good to know. So why is it like this? Is there no way to programmatically lint these files?
>
> *I think my issue earlier, and from yesterday were related to copy/paste from outside applications. *sigh* I knew better than that.. I swear!
>
> From: David Lang <david@lang.hm>
> Date: Monday, August 29, 2022 at 3:45 PM
> To: Ben Hart <ben.hart@jamf.com>
> Cc: David Lang <david@lang.hm>, Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
> when I have this problem, I just start at the beginning, search for double
> quotes and step through the entire file (don't forget included files) and then I
> do it again for single quotes.
>
> I've had the actual error be 20+ lines earlier than the first reported issue.
>
> David Lang
>
> On Mon, 29 Aug 2022, Ben Hart wrote:
>
>> Yup, encountered that problem before which is why I included what I hoped would be enough char/lines before the indicated one. I?ve stared at this in Nano so long I?m going cross-eyed.
>> I don?t have anyone else who knows the format to even ask for their eyes..
>>
>> From: David Lang <david@lang.hm>
>> Date: Monday, August 29, 2022 at 3:37 PM
>> To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
>> Cc: Ben Hart <ben.hart@jamf.com>
>> Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
>> that sort of error typically means that somewhere prior to this line there are
>> mismatched quotes, sometimes far before.
>>
>> David Lang
>>
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Error with omfile and queue.filename syntax? [ In reply to ]
(Was reading through your article from 2014 on Syslog Perf)

No thank you for the advice.. that?s one reason I?m in the list! These rsyslog servers are going to receive lots of messages from up two a couple dozen sources each so I?m really wanting the best initial config I can scope. I know tweaking will take place but I?d rather they didn?t fall flat on their faces on day 1.

The description of asyncWriting does leave an impression of a tiny but extra cpu load, but what?s unclear except from maybe years of experience, is how impactful versus the gains.

From: David Lang <david@lang.hm>
Date: Monday, August 29, 2022 at 3:51 PM
To: Ben Hart via rsyslog <rsyslog@lists.adiscon.com>
Cc: Ben Hart <ben.hart@jamf.com>
Subject: Re: [rsyslog] Error with omfile and queue.filename syntax?
by the way, async writes on omfile are almost never a good idea, it adds an
extra queue between the omfile module and the write, and the locking on that
queue adds more overhead than the write would. The place it has some use is
where your output has a significant amount of processing (compressed output for
example), and even then you have to check.

not the issue you are posting about, but something I noticed in the config.

David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.