Mailing List Archive

just pointing out that 8.2302 is releasing this month (if it didn't get released
already, so the version you are using is 3 years old.

I think I remember reading about this, there are multiple names for some of the
facilities and it sounds as if the version of logger you are using doesn't
support the name audit. That's not a problem with rsyslog, because rsyslog
doesn't get the name from logger it gets the PRI value, which is a number.

but in the rsyslog configs, I think there were changes to support multiple
versions of some names for compatibility.

without seeing your config, we can't be sure what's wrong, but try upgrading to
a more recent version and see if the problem (with your config not working as
expected) was fixed in the meantime. If it still isn't working, please post the
config

David Lang


On Tue, 21 Feb 2023, Carlos García García via rsyslog wrote:

> Date: Tue, 21 Feb 2023 11:47:42 +0100
> From: Carlos García García via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Carlos García García <carlos.garcia@procesia.com>
> Subject: [rsyslog] CSWrsyslog v8.2002 event wrong "audit.notice" under SO
> Solaris 11.3
>
> Hello,
>
> I´m a new member of this wondefull group.
>
> We have a problem with a CSWrsyslog package v8.2002 under SO Solaris 11.3
>
> I explain:
>
> In the file /etc/rsyslog.conf is configurated a facility "audit.notice"
> for send to file: /var/log/audit_syslog.log
>
> This configuration above no register any log lines.
>
> When we execute command: logger -p audit.notice "This is a probe"
> display messages: unknow facility name audit
>
> Please, had you have some similar issue, they communicate us.
>
> Thanks very much
>
> Nice to meet you
>
>
>
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Good afternoon...

Thanks for support.

Regards

El 21/02/2023 a las 12:04, David Lang escribió:
> just pointing out that 8.2302 is releasing this month (if it didn't
> get released already, so the version you are using is 3 years old.
>
> I think I remember reading about this, there are multiple names for
> some of the facilities and it sounds as if the version of logger you
> are using doesn't support the name audit. That's not a problem with
> rsyslog, because rsyslog doesn't get the name from logger it gets the
> PRI value, which is a number.
>
> but in the rsyslog configs, I think there were changes to support
> multiple versions of some names for compatibility.
>
> without seeing your config, we can't be sure what's wrong, but try
> upgrading to a more recent version and see if the problem (with your
> config not working as expected) was fixed in the meantime. If it still
> isn't working, please post the config
>
> David Lang
>
>
> On Tue, 21 Feb 2023, Carlos García García via rsyslog wrote:
>
>> Date: Tue, 21 Feb 2023 11:47:42 +0100
>> From: Carlos García García via rsyslog <rsyslog@lists.adiscon.com>
>> To: rsyslog@lists.adiscon.com
>> Cc: Carlos García García <carlos.garcia@procesia.com>
>> Subject: [rsyslog] CSWrsyslog v8.2002 event wrong "audit.notice"
>> under SO
>>     Solaris 11.3
>>
>> Hello,
>>
>> I´m a new member of this wondefull group.
>>
>> We have a problem with a CSWrsyslog package v8.2002 under SO Solaris
>> 11.3
>>
>> I explain:
>>
>> In the file /etc/rsyslog.conf is configurated a facility
>> "audit.notice" for send to file: /var/log/audit_syslog.log
>>
>> This configuration above no register any log lines.
>>
>> When we execute command: logger -p audit.notice "This is a probe"
>> display messages: unknow facility name audit
>>
>> Please, had you have some similar issue, they communicate us.
>>
>> Thanks very much
>>
>> Nice to meet you
>>
>>
>>
>>
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>> POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

8.2302 was released this week.

David Lang

On Thu, 23 Feb 2023, Carlos García García wrote:

> Date: Thu, 23 Feb 2023 13:05:29 +0100
> From: Carlos García García <carlos.garcia@procesia.com>
> To: David Lang <david@lang.hm>,
> Carlos García García via rsyslog <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] CSWrsyslog v8.2002 event wrong "audit.notice" under SO
> Solaris 11.3
>
> Good afternoon...
>
> Thanks for support.
>
> Regards
>
> El 21/02/2023 a las 12:04, David Lang escribió:
>> just pointing out that 8.2302 is releasing this month (if it didn't get
>> released already, so the version you are using is 3 years old.
>>
>> I think I remember reading about this, there are multiple names for some of
>> the facilities and it sounds as if the version of logger you are using
>> doesn't support the name audit. That's not a problem with rsyslog, because
>> rsyslog doesn't get the name from logger it gets the PRI value, which is a
>> number.
>>
>> but in the rsyslog configs, I think there were changes to support multiple
>> versions of some names for compatibility.
>>
>> without seeing your config, we can't be sure what's wrong, but try
>> upgrading to a more recent version and see if the problem (with your config
>> not working as expected) was fixed in the meantime. If it still isn't
>> working, please post the config
>>
>> David Lang
>>
>>
>> On Tue, 21 Feb 2023, Carlos García García via rsyslog wrote:
>>
>>> Date: Tue, 21 Feb 2023 11:47:42 +0100
>>> From: Carlos García García via rsyslog <rsyslog@lists.adiscon.com>
>>> To: rsyslog@lists.adiscon.com
>>> Cc: Carlos García García <carlos.garcia@procesia.com>
>>> Subject: [rsyslog] CSWrsyslog v8.2002 event wrong "audit.notice" under SO
>>>     Solaris 11.3
>>>
>>> Hello,
>>>
>>> I´m a new member of this wondefull group.
>>>
>>> We have a problem with a CSWrsyslog package v8.2002 under SO Solaris 11.3
>>>
>>> I explain:
>>>
>>> In the file /etc/rsyslog.conf is configurated a facility "audit.notice"
>>> for send to file: /var/log/audit_syslog.log
>>>
>>> This configuration above no register any log lines.
>>>
>>> When we execute command: logger -p audit.notice "This is a probe" display
>>> messages: unknow facility name audit
>>>
>>> Please, had you have some similar issue, they communicate us.
>>>
>>> Thanks very much
>>>
>>> Nice to meet you
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.