Mailing List Archive

Afternoon all! So I?ve encountered another syntax problem.. this time with a specific rsyslog.d/conf file. Here?s an error snippet:

root@server:/etc/rsyslog.d# rsyslogd -N1 -f 15-remote-syslog.conf
rsyslogd: version 8.2112.0, config validation run (level 1), master config 15-remote-syslog.conf
rsyslogd: input module name 'imudp' is unknown [v8.2112.0 try https://www.rsyslog.com/e/2209 ]
rsyslogd: error during parsing file 15-remote-syslog.conf, on or before line 83: parameter 'ruleset' not known -- typo in config file? [v8.2112.0 try https://www.rsyslog.com/e/2207 ]
rsyslogd: error during parsing file 15-remote-syslog.conf, on or before line 83: parameter 'port' not known -- typo in config file? [v8.2112.0 try https://www.rsyslog.com/e/2207 ]
rsyslogd: input module name 'imudp' is unknown [v8.2112.0 try https://www.rsyslog.com/e/2209 ]
rsyslogd: error during parsing file 15-remote-syslog.conf, on or before line 84: parameter 'ruleset' not known -- typo in config file? [v8.2112.0 try https://www.rsyslog.com/e/2207 ]

And so on from line 83 ? 94, which is the entire binding block. The conf file is long so I won?t paste the entire contents but here is a snippet:

ruleset(name="amp20528" queue.type="linkedlist" queue.workerThreads="4" queue.workerThreadMinimumMessages="20000"){
action(type="omfile" file="/var/log/remote-syslog/amp.log" ioBufferSize="64k" flushOnTXEnd="off")
}
input(type="imudp" port="20514" ruleset="switches20514")


There are 12 rulesets, with 12 inputs/bindings at the bottom of the file. The quotation marks are 100% correct, as well as the other punctuation marks. Each ruleset is identical save the name and log file name (meaning the paths are the same).

Rsyslog.conf contains:


$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad immark # provides --MARK-- message capability

module(load="imudp")
input(type="imudp" port=["20514","20515","20516","20517","20518","20519","20520","20524","20525","20526","20527","20528"]
name="" name.appendPort="on")

module(load="impstats" interval="10" log.file="/var/log/rsyslog_stats.log" log.syslog="off")

(the default lines for file permissions and the $Include statement at the bottom)

I?ve been fighting this for about 5 hours today trying all manner of things. I eliminated the possibility of file encoding issues.. all the forking conf files are us-ascii just like this one. I get the feeling that the module load might be the source of the problem but I came across a RH forum post showing the defining of the bindings, in rsyslog.conf directly under the module(load=?imudp?) line.. maybe that?s it?

Thanks!

[Jamf]


Ben Hart
IT Systems Administrator II
100 Washington Ave S, Minneapolis, MN 55401
[Phone]
+00 1 989 424 0187
[Email]
ben.hart@jamf.com
[Web]
www.jamf.com<https://www.jamf.com>
[Facebook] [Twitter] [LinkedIn] [YouTube]