Mailing List Archive: imrelp - no messages processed

imrelp - no messages processed

Feb 24, 2023, 6:41 AM

Post #1 of 9 (402 views)

Hi everyone,

I'm trying to put rsyslog into a docker container with the imrelp module. Setup is quite easy:

rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp" port="2514" maxDataSize="10k" keepAlive="on")

Unfortunately, there are no logs, but service looks fine. Logger is working with UDP (imudp module) but not in imrelp tcp. When I tried the ptcp module, logging worked fine.

Setup:
Ubuntu - 22.04 LTS, 5.15.0-56-generic
docker version
Client: Docker Engine - Community
Version: 23.0.1
API version: 1.42
Go version: go1.19.5
Git commit: a5ee5b1
Built: Thu Feb 9 19:47:01 2023
OS/Arch: linux/amd64
Context: default

Server: Docker Engine - Community
Engine:
Version: 23.0.1
API version: 1.42 (minimum version 1.12)
Go version: go1.19.5
Git commit: bc3805a
Built: Thu Feb 9 19:47:01 2023
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.18
GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d
docker-init:
Version: 0.19.0
GitCommit: de40ad0

rsyslog - 8.2302
rsyslog-relp - 8.2302
librelp0 - 1.11.0

When I try to connect to imrelp with telnet and close the session, I receive this error:

v8.2302 (docker)
syslog.err rsyslogd: imrelp[2514]: error 'server closed relp session, session broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' - input may not work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353 ]
v8.1901 (no docker)
syslog.err rsyslogd: imrelp[514]: error 'server closed relp session, session broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353 ]
v8.2112 (no docker)
syslog.err syslogd: imrelp[514]: error 'server closed relp session, session broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353 ]

When I ran rsyslog in debug mode, nothing unusual showed up. (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)

Is there something that I'm missing on this basic setup ?

Thank you for any advice

Best regards,

Tomas Bekecs

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 24, 2023, 9:23 AM

Post #2 of 9 (402 views)

Permalink

what is the rest of your config? what you have shown is the config to receive
logs, but not any instructions to rsyslog to write logs out.

David Lang

On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:

> Date: Fri, 24 Feb 2023 15:41:42 +0100
> From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Jozef Zajac <zajac.jozko@centrum.sk>
> Subject: [rsyslog] imrelp - no messages processed
>
> Hi everyone,
>
>
> I'm trying to put rsyslog into a docker container with the imrelp module.
> Setup is quite easy:
>
>
> rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
> rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
> port="2514" maxDataSize="10k" keepAlive="on")
>
>
> Unfortunately, there are no logs, but service looks fine. Logger is working
> with UDP (imudp module) but not in imrelp tcp. When I tried the ptcp module,
> logging worked fine.
>
>
> Setup:
> Ubuntu - 22.04 LTS, 5.15.0-56-generic
> docker version
> Client: Docker Engine - Community
> Version: 23.0.1
> API version: 1.42
> Go version: go1.19.5
> Git commit: a5ee5b1
> Built: Thu Feb 9 19:47:01 2023
> OS/Arch: linux/amd64
> Context: default
>
>
> Server: Docker Engine - Community
> Engine:
> Version: 23.0.1
> API version: 1.42 (minimum version 1.12)
> Go version: go1.19.5
> Git commit: bc3805a
> Built: Thu Feb 9 19:47:01 2023
> OS/Arch: linux/amd64
> Experimental: false
> containerd:
> Version: 1.6.18
> GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
> runc:
> Version: 1.1.4
> GitCommit: v1.1.4-0-g5fd4c4d
> docker-init:
> Version: 0.19.0
> GitCommit: de40ad0
>
>
> rsyslog - 8.2302
> rsyslog-relp - 8.2302
> librelp0 - 1.11.0
>
>
> When I try to connect to imrelp with telnet and close the session, I receive
> this error:
>
> v8.2302 (docker)
> syslog.err rsyslogd: imrelp[2514]: error 'server closed relp session, session
> broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' - input may not
> work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353 ]
> v8.1901 (no docker)
> syslog.err rsyslogd: imrelp[514]: error 'server closed relp session, session
> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not
> work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353 ]
> v8.2112 (no docker)
> syslog.err syslogd: imrelp[514]: error 'server closed relp session, session
> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not
> work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353 ]
>
>
> When I ran rsyslog in debug mode, nothing unusual showed up.
> (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
>
>
>
> Is there something that I'm missing on this basic setup ?
>
>
> Thank you for any advice
>
>
> Best regards,
>
>
> Tomas Bekecs
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 24, 2023, 9:24 AM

Post #3 of 9 (402 views)

Permalink

also: do you send a proper RELP greeting via telnet? If not, this is
the reason the connection is closed.

Rainer

El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> what is the rest of your config? what you have shown is the config to receive
> logs, but not any instructions to rsyslog to write logs out.
>
> David Lang
>
> On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
>
> > Date: Fri, 24 Feb 2023 15:41:42 +0100
> > From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
> > To: rsyslog@lists.adiscon.com
> > Cc: Jozef Zajac <zajac.jozko@centrum.sk>
> > Subject: [rsyslog] imrelp - no messages processed
> >
> > Hi everyone,
> >
> >
> > I'm trying to put rsyslog into a docker container with the imrelp module.
> > Setup is quite easy:
> >
> >
> > rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
> > rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
> > port="2514" maxDataSize="10k" keepAlive="on")
> >
> >
> > Unfortunately, there are no logs, but service looks fine. Logger is working
> > with UDP (imudp module) but not in imrelp tcp. When I tried the ptcp module,
> > logging worked fine.
> >
> >
> > Setup:
> > Ubuntu - 22.04 LTS, 5.15.0-56-generic
> > docker version
> > Client: Docker Engine - Community
> > Version: 23.0.1
> > API version: 1.42
> > Go version: go1.19.5
> > Git commit: a5ee5b1
> > Built: Thu Feb 9 19:47:01 2023
> > OS/Arch: linux/amd64
> > Context: default
> >
> >
> > Server: Docker Engine - Community
> > Engine:
> > Version: 23.0.1
> > API version: 1.42 (minimum version 1.12)
> > Go version: go1.19.5
> > Git commit: bc3805a
> > Built: Thu Feb 9 19:47:01 2023
> > OS/Arch: linux/amd64
> > Experimental: false
> > containerd:
> > Version: 1.6.18
> > GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
> > runc:
> > Version: 1.1.4
> > GitCommit: v1.1.4-0-g5fd4c4d
> > docker-init:
> > Version: 0.19.0
> > GitCommit: de40ad0
> >
> >
> > rsyslog - 8.2302
> > rsyslog-relp - 8.2302
> > librelp0 - 1.11.0
> >
> >
> > When I try to connect to imrelp with telnet and close the session, I receive
> > this error:
> >
> > v8.2302 (docker)
> > syslog.err rsyslogd: imrelp[2514]: error 'server closed relp session, session
> > broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' - input may not
> > work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353 ]
> > v8.1901 (no docker)
> > syslog.err rsyslogd: imrelp[514]: error 'server closed relp session, session
> > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not
> > work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353 ]
> > v8.2112 (no docker)
> > syslog.err syslogd: imrelp[514]: error 'server closed relp session, session
> > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not
> > work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353 ]
> >
> >
> > When I ran rsyslog in debug mode, nothing unusual showed up.
> > (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
> >
> >
> >
> > Is there something that I'm missing on this basic setup ?
> >
> >
> > Thank you for any advice
> >
> >
> > Best regards,
> >
> >
> > Tomas Bekecs
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> > LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 27, 2023, 5:40 AM

Post #4 of 9 (395 views)

Permalink

After additional testing seems that configuration is correct.
Messages were processed correctly when we send them via omrelp. Basic testing with logger was not successful.
It mean that if we want use imrelp then also client has to send messages via omrelp? As we were not able process messages via logger or omfwd it look so.

Best Regards,
Jozef
______________________________________________________________
> Od: "Rainer Gerhards via rsyslog" <rsyslog@lists.adiscon.com>
> Komu: "rsyslog-users" <rsyslog@lists.adiscon.com>
> Dátum: 24.02.2023 18:25
> Predmet: Re: [rsyslog] imrelp - no messages processed
>
> CC: <rgerhards@hq.adiscon.com>
also: do you send a proper RELP greeting via telnet? If not, this is
the reason the connection is closed.

Rainer
El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> what is the rest of your config? what you have shown is the config to receive
> logs, but not any instructions to rsyslog to write logs out.
>
> David Lang
>
> On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
>
> > Date: Fri, 24 Feb 2023 15:41:42 +0100
> > From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
> > To: rsyslog@lists.adiscon.com
> > Cc: Jozef Zajac <zajac.jozko@centrum.sk>
> > Subject: [rsyslog] imrelp - no messages processed
> >
> > Hi everyone,
> >
> >
> > I'm trying to put rsyslog into a docker container with the imrelp module.
> > Setup is quite easy:
> >
> >
> > rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
> > rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
> > port="2514" maxDataSize="10k" keepAlive="on")
> >
> >
> > Unfortunately, there are no logs, but service looks fine. Logger is working
> > with UDP (imudp module) but not in imrelp tcp. When I tried the ptcp module,
> > logging worked fine.
> >
> >
> > Setup:
> > Ubuntu - 22.04 LTS, 5.15.0-56-generic
> > docker version
> > Client: Docker Engine - Community
> > Version: 23.0.1
> > API version: 1.42
> > Go version: go1.19.5
> > Git commit: a5ee5b1
> > Built: Thu Feb 9 19:47:01 2023
> > OS/Arch: linux/amd64
> > Context: default
> >
> >
> > Server: Docker Engine - Community
> > Engine:
> > Version: 23.0.1
> > API version: 1.42 (minimum version 1.12)
> > Go version: go1.19.5
> > Git commit: bc3805a
> > Built: Thu Feb 9 19:47:01 2023
> > OS/Arch: linux/amd64
> > Experimental: false
> > containerd:
> > Version: 1.6.18
> > GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
> > runc:
> > Version: 1.1.4
> > GitCommit: v1.1.4-0-g5fd4c4d
> > docker-init:
> > Version: 0.19.0
> > GitCommit: de40ad0
> >
> >
> > rsyslog - 8.2302
> > rsyslog-relp - 8.2302
> > librelp0 - 1.11.0
> >
> >
> > When I try to connect to imrelp with telnet and close the session, I receive
> > this error:
> >
> > v8.2302 (docker)
> > syslog.err rsyslogd: imrelp[2514]: error 'server closed relp session, session
> > broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' - input may not
> > work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353 <https://www.rsyslog.com/e/2353> ]
> > v8.1901 (no docker)
> > syslog.err rsyslogd: imrelp[514]: error 'server closed relp session, session
> > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not
> > work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353 <https://www.rsyslog.com/e/2353> ]
> > v8.2112 (no docker)
> > syslog.err syslogd: imrelp[514]: error 'server closed relp session, session
> > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' - input may not
> > work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353 <https://www.rsyslog.com/e/2353> ]
> >
> >
> > When I ran rsyslog in debug mode, nothing unusual showed up.
> > (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
> >
> >
> >
> > Is there something that I'm missing on this basic setup ?
> >
> >
> > Thank you for any advice
> >
> >
> > Best regards,
> >
> >
> > Tomas Bekecs
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> > http://www.rsyslog.com/professional-services/ <http://www.rsyslog.com/professional-services/>
> > What's up with rsyslog? Follow https://twitter.com/rgerhards <https://twitter.com/rgerhards>
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> > LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/professional-services/ <http://www.rsyslog.com/professional-services/>
> What's up with rsyslog? Follow https://twitter.com/rgerhards <https://twitter.com/rgerhards>
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog <https://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/professional-services/ <http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards <https://twitter.com/rgerhards>
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 27, 2023, 5:47 AM

Post #5 of 9 (395 views)

Permalink

Well, logger sends where you tell him to send (either local socket or to
the specified "plain syslog" TCP/UDP destination) whereas rsyslogd will
listen on whatver inputs you specify in your config.

So if you specify _only_ RELP inputs, you won't be able to send data any
other way.

On 27.02.2023 14:40, Jozef Zajac via rsyslog wrote:
> After additional testing seems that configuration is correct.
> Messages were processed correctly when we send them via omrelp. Basic
> testing with logger was not successful.
> It mean that if we want use imrelp then also client has to send
> messages via omrelp? As we were not able process messages via logger
> or omfwd it look so.
>
> Best Regards,
> Jozef
> ______________________________________________________________
>> Od: "Rainer Gerhards via rsyslog" <rsyslog@lists.adiscon.com>
>> Komu: "rsyslog-users" <rsyslog@lists.adiscon.com>
>> Dátum: 24.02.2023 18:25
>> Predmet: Re: [rsyslog] imrelp - no messages processed
>>
>> CC: <rgerhards@hq.adiscon.com>
> also: do you send a proper RELP greeting via telnet? If not, this is
> the reason the connection is closed.
>
> Rainer
> El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
> >
> > what is the rest of your config? what you have shown is the config
> to receive
> > logs, but not any instructions to rsyslog to write logs out.
> >
> > David Lang
> >
> > On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
> >
> > > Date: Fri, 24 Feb 2023 15:41:42 +0100
> > > From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
> > > To: rsyslog@lists.adiscon.com
> > > Cc: Jozef Zajac <zajac.jozko@centrum.sk>
> > > Subject: [rsyslog] imrelp - no messages processed
> > >
> > > Hi everyone,
> > >
> > >
> > > I'm trying to put rsyslog into a docker container with the imrelp
> module.
> > > Setup is quite easy:
> > >
> > >
> > > rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
> > > rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
> > > port="2514" maxDataSize="10k" keepAlive="on")
> > >
> > >
> > > Unfortunately, there are no logs, but service looks fine. Logger
> is working
> > > with UDP (imudp module) but not in imrelp tcp. When I tried the
> ptcp module,
> > > logging worked fine.
> > >
> > >
> > > Setup:
> > > Ubuntu - 22.04 LTS, 5.15.0-56-generic
> > > docker version
> > > Client: Docker Engine - Community
> > > Version: 23.0.1
> > > API version: 1.42
> > > Go version: go1.19.5
> > > Git commit: a5ee5b1
> > > Built: Thu Feb 9 19:47:01 2023
> > > OS/Arch: linux/amd64
> > > Context: default
> > >
> > >
> > > Server: Docker Engine - Community
> > > Engine:
> > > Version: 23.0.1
> > > API version: 1.42 (minimum version 1.12)
> > > Go version: go1.19.5
> > > Git commit: bc3805a
> > > Built: Thu Feb 9 19:47:01 2023
> > > OS/Arch: linux/amd64
> > > Experimental: false
> > > containerd:
> > > Version: 1.6.18
> > > GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
> > > runc:
> > > Version: 1.1.4
> > > GitCommit: v1.1.4-0-g5fd4c4d
> > > docker-init:
> > > Version: 0.19.0
> > > GitCommit: de40ad0
> > >
> > >
> > > rsyslog - 8.2302
> > > rsyslog-relp - 8.2302
> > > librelp0 - 1.11.0
> > >
> > >
> > > When I try to connect to imrelp with telnet and close the session,
> I receive
> > > this error:
> > >
> > > v8.2302 (docker)
> > > syslog.err rsyslogd: imrelp[2514]: error 'server closed relp
> session, session
> > > broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' -
> input may not
> > > work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353
> <https://www.rsyslog.com/e/2353> ]
> > > v8.1901 (no docker)
> > > syslog.err rsyslogd: imrelp[514]: error 'server closed relp
> session, session
> > > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
> input may not
> > > work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353
> <https://www.rsyslog.com/e/2353> ]
> > > v8.2112 (no docker)
> > > syslog.err syslogd: imrelp[514]: error 'server closed relp
> session, session
> > > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
> input may not
> > > work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353
> <https://www.rsyslog.com/e/2353> ]
> > >
> > >
> > > When I ran rsyslog in debug mode, nothing unusual showed up.
> > > (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
> > >
> > >
> > >
> > > Is there something that I'm missing on this basic setup ?
> > >
> > >
> > > Thank you for any advice
> > >
> > >
> > > Best regards,
> > >
> > >
> > > Tomas Bekecs
> > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > https://lists.adiscon.net/mailman/listinfo/rsyslog
> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> > > http://www.rsyslog.com/professional-services/
> <http://www.rsyslog.com/professional-services/>
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> <https://twitter.com/rgerhards>
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of
> > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
> you DON'T
> > > LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> > http://www.rsyslog.com/professional-services/
> <http://www.rsyslog.com/professional-services/>
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> <https://twitter.com/rgerhards>
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/professional-services/
> <http://www.rsyslog.com/professional-services/>
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> <https://twitter.com/rgerhards>
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 27, 2023, 6:11 AM

Post #6 of 9 (395 views)

Permalink

To clarify this issue more. If I use imrelp on the server side, only data
which will be sent and proceed are through omrelp ? I'm asking because
processing where client is using omfwd and server have imptcp is working.
Tests via logger are working on imptcp, imtcp modules, but not in imrelp
module

On Mon, Feb 27, 2023 at 2:47 PM Mariusz Kruk via rsyslog <
rsyslog@lists.adiscon.com> wrote:

> Well, logger sends where you tell him to send (either local socket or to
> the specified "plain syslog" TCP/UDP destination) whereas rsyslogd will
> listen on whatver inputs you specify in your config.
>
> So if you specify _only_ RELP inputs, you won't be able to send data any
> other way.
>
> On 27.02.2023 14:40, Jozef Zajac via rsyslog wrote:
> > After additional testing seems that configuration is correct.
> > Messages were processed correctly when we send them via omrelp. Basic
> > testing with logger was not successful.
> > It mean that if we want use imrelp then also client has to send
> > messages via omrelp? As we were not able process messages via logger
> > or omfwd it look so.
> >
> > Best Regards,
> > Jozef
> > ______________________________________________________________
> >> Od: "Rainer Gerhards via rsyslog" <rsyslog@lists.adiscon.com>
> >> Komu: "rsyslog-users" <rsyslog@lists.adiscon.com>
> >> Dátum: 24.02.2023 18:25
> >> Predmet: Re: [rsyslog] imrelp - no messages processed
> >>
> >> CC: <rgerhards@hq.adiscon.com>
> > also: do you send a proper RELP greeting via telnet? If not, this is
> > the reason the connection is closed.
> >
> > Rainer
> > El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
> > (<rsyslog@lists.adiscon.com>) escribió:
> > >
> > > what is the rest of your config? what you have shown is the config
> > to receive
> > > logs, but not any instructions to rsyslog to write logs out.
> > >
> > > David Lang
> > >
> > > On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
> > >
> > > > Date: Fri, 24 Feb 2023 15:41:42 +0100
> > > > From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
> > > > To: rsyslog@lists.adiscon.com
> > > > Cc: Jozef Zajac <zajac.jozko@centrum.sk>
> > > > Subject: [rsyslog] imrelp - no messages processed
> > > >
> > > > Hi everyone,
> > > >
> > > >
> > > > I'm trying to put rsyslog into a docker container with the imrelp
> > module.
> > > > Setup is quite easy:
> > > >
> > > >
> > > > rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
> > > > rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
> > > > port="2514" maxDataSize="10k" keepAlive="on")
> > > >
> > > >
> > > > Unfortunately, there are no logs, but service looks fine. Logger
> > is working
> > > > with UDP (imudp module) but not in imrelp tcp. When I tried the
> > ptcp module,
> > > > logging worked fine.
> > > >
> > > >
> > > > Setup:
> > > > Ubuntu - 22.04 LTS, 5.15.0-56-generic
> > > > docker version
> > > > Client: Docker Engine - Community
> > > > Version: 23.0.1
> > > > API version: 1.42
> > > > Go version: go1.19.5
> > > > Git commit: a5ee5b1
> > > > Built: Thu Feb 9 19:47:01 2023
> > > > OS/Arch: linux/amd64
> > > > Context: default
> > > >
> > > >
> > > > Server: Docker Engine - Community
> > > > Engine:
> > > > Version: 23.0.1
> > > > API version: 1.42 (minimum version 1.12)
> > > > Go version: go1.19.5
> > > > Git commit: bc3805a
> > > > Built: Thu Feb 9 19:47:01 2023
> > > > OS/Arch: linux/amd64
> > > > Experimental: false
> > > > containerd:
> > > > Version: 1.6.18
> > > > GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
> > > > runc:
> > > > Version: 1.1.4
> > > > GitCommit: v1.1.4-0-g5fd4c4d
> > > > docker-init:
> > > > Version: 0.19.0
> > > > GitCommit: de40ad0
> > > >
> > > >
> > > > rsyslog - 8.2302
> > > > rsyslog-relp - 8.2302
> > > > librelp0 - 1.11.0
> > > >
> > > >
> > > > When I try to connect to imrelp with telnet and close the session,
> > I receive
> > > > this error:
> > > >
> > > > v8.2302 (docker)
> > > > syslog.err rsyslogd: imrelp[2514]: error 'server closed relp
> > session, session
> > > > broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' -
> > input may not
> > > > work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353
> > <https://www.rsyslog.com/e/2353> ]
> > > > v8.1901 (no docker)
> > > > syslog.err rsyslogd: imrelp[514]: error 'server closed relp
> > session, session
> > > > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
> > input may not
> > > > work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353
> > <https://www.rsyslog.com/e/2353> ]
> > > > v8.2112 (no docker)
> > > > syslog.err syslogd: imrelp[514]: error 'server closed relp
> > session, session
> > > > broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
> > input may not
> > > > work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353
> > <https://www.rsyslog.com/e/2353> ]
> > > >
> > > >
> > > > When I ran rsyslog in debug mode, nothing unusual showed up.
> > > > (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
> > > >
> > > >
> > > >
> > > > Is there something that I'm missing on this basic setup ?
> > > >
> > > >
> > > > Thank you for any advice
> > > >
> > > >
> > > > Best regards,
> > > >
> > > >
> > > > Tomas Bekecs
> > > >
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> > > > http://www.rsyslog.com/professional-services/
> > <http://www.rsyslog.com/professional-services/>
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > <https://twitter.com/rgerhards>
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of
> > > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
> > you DON'T
> > > > LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> > > http://www.rsyslog.com/professional-services/
> > <http://www.rsyslog.com/professional-services/>
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > <https://twitter.com/rgerhards>
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> > if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> > http://www.rsyslog.com/professional-services/
> > <http://www.rsyslog.com/professional-services/>
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > <https://twitter.com/rgerhards>
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> > if you DON'T LIKE THAT.
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> > if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 27, 2023, 6:14 AM

Post #7 of 9 (395 views)

Permalink

Yes, imrelp is an extended packet delivery verification technology implemented on top of plain TCP. It requires both transmitter and receiver to use it.

> On Feb 27, 2023, at 08:11, Tomas Bekecs Zvarillo via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> To clarify this issue more. If I use imrelp on the server side, only data
> which will be sent and proceed are through omrelp ? I'm asking because
> processing where client is using omfwd and server have imptcp is working.
> Tests via logger are working on imptcp, imtcp modules, but not in imrelp
> module
>
> On Mon, Feb 27, 2023 at 2:47 PM Mariusz Kruk via rsyslog <
> rsyslog@lists.adiscon.com> wrote:
>
>> Well, logger sends where you tell him to send (either local socket or to
>> the specified "plain syslog" TCP/UDP destination) whereas rsyslogd will
>> listen on whatver inputs you specify in your config.
>>
>> So if you specify _only_ RELP inputs, you won't be able to send data any
>> other way.
>>
>> On 27.02.2023 14:40, Jozef Zajac via rsyslog wrote:
>>> After additional testing seems that configuration is correct.
>>> Messages were processed correctly when we send them via omrelp. Basic
>>> testing with logger was not successful.
>>> It mean that if we want use imrelp then also client has to send
>>> messages via omrelp? As we were not able process messages via logger
>>> or omfwd it look so.
>>>
>>> Best Regards,
>>> Jozef
>>> ______________________________________________________________
>>>> Od: "Rainer Gerhards via rsyslog" <rsyslog@lists.adiscon.com>
>>>> Komu: "rsyslog-users" <rsyslog@lists.adiscon.com>
>>>> Dátum: 24.02.2023 18:25
>>>> Predmet: Re: [rsyslog] imrelp - no messages processed
>>>>
>>>> CC: <rgerhards@hq.adiscon.com>
>>> also: do you send a proper RELP greeting via telnet? If not, this is
>>> the reason the connection is closed.
>>>
>>> Rainer
>>> El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
>>> (<rsyslog@lists.adiscon.com>) escribió:
>>>>
>>>> what is the rest of your config? what you have shown is the config
>>> to receive
>>>> logs, but not any instructions to rsyslog to write logs out.
>>>>
>>>> David Lang
>>>>
>>>> On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
>>>>
>>>>> Date: Fri, 24 Feb 2023 15:41:42 +0100
>>>>> From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
>>>>> To: rsyslog@lists.adiscon.com
>>>>> Cc: Jozef Zajac <zajac.jozko@centrum.sk>
>>>>> Subject: [rsyslog] imrelp - no messages processed
>>>>>
>>>>> Hi everyone,
>>>>>
>>>>>
>>>>> I'm trying to put rsyslog into a docker container with the imrelp
>>> module.
>>>>> Setup is quite easy:
>>>>>
>>>>>
>>>>> rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
>>>>> rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
>>>>> port="2514" maxDataSize="10k" keepAlive="on")
>>>>>
>>>>>
>>>>> Unfortunately, there are no logs, but service looks fine. Logger
>>> is working
>>>>> with UDP (imudp module) but not in imrelp tcp. When I tried the
>>> ptcp module,
>>>>> logging worked fine.
>>>>>
>>>>>
>>>>> Setup:
>>>>> Ubuntu - 22.04 LTS, 5.15.0-56-generic
>>>>> docker version
>>>>> Client: Docker Engine - Community
>>>>> Version: 23.0.1
>>>>> API version: 1.42
>>>>> Go version: go1.19.5
>>>>> Git commit: a5ee5b1
>>>>> Built: Thu Feb 9 19:47:01 2023
>>>>> OS/Arch: linux/amd64
>>>>> Context: default
>>>>>
>>>>>
>>>>> Server: Docker Engine - Community
>>>>> Engine:
>>>>> Version: 23.0.1
>>>>> API version: 1.42 (minimum version 1.12)
>>>>> Go version: go1.19.5
>>>>> Git commit: bc3805a
>>>>> Built: Thu Feb 9 19:47:01 2023
>>>>> OS/Arch: linux/amd64
>>>>> Experimental: false
>>>>> containerd:
>>>>> Version: 1.6.18
>>>>> GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
>>>>> runc:
>>>>> Version: 1.1.4
>>>>> GitCommit: v1.1.4-0-g5fd4c4d
>>>>> docker-init:
>>>>> Version: 0.19.0
>>>>> GitCommit: de40ad0
>>>>>
>>>>>
>>>>> rsyslog - 8.2302
>>>>> rsyslog-relp - 8.2302
>>>>> librelp0 - 1.11.0
>>>>>
>>>>>
>>>>> When I try to connect to imrelp with telnet and close the session,
>>> I receive
>>>>> this error:
>>>>>
>>>>> v8.2302 (docker)
>>>>> syslog.err rsyslogd: imrelp[2514]: error 'server closed relp
>>> session, session
>>>>> broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' -
>>> input may not
>>>>> work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353
>>> <https://www.rsyslog.com/e/2353> ]
>>>>> v8.1901 (no docker)
>>>>> syslog.err rsyslogd: imrelp[514]: error 'server closed relp
>>> session, session
>>>>> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
>>> input may not
>>>>> work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353
>>> <https://www.rsyslog.com/e/2353> ]
>>>>> v8.2112 (no docker)
>>>>> syslog.err syslogd: imrelp[514]: error 'server closed relp
>>> session, session
>>>>> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
>>> input may not
>>>>> work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353
>>> <https://www.rsyslog.com/e/2353> ]
>>>>>
>>>>>
>>>>> When I ran rsyslog in debug mode, nothing unusual showed up.
>>>>> (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
>>>>>
>>>>>
>>>>>
>>>>> Is there something that I'm missing on this basic setup ?
>>>>>
>>>>>
>>>>> Thank you for any advice
>>>>>
>>>>>
>>>>> Best regards,
>>>>>
>>>>>
>>>>> Tomas Bekecs
>>>>>
>>>>> _______________________________________________
>>>>> rsyslog mailing list
>>>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>> http://www.rsyslog.com/professional-services/
>>> <http://www.rsyslog.com/professional-services/>
>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> <https://twitter.com/rgerhards>
>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of
>>>>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>>> you DON'T
>>>>> LIKE THAT.
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>> http://www.rsyslog.com/professional-services/
>>> <http://www.rsyslog.com/professional-services/>
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> <https://twitter.com/rgerhards>
>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>>> if you DON'T LIKE THAT.
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
>>> http://www.rsyslog.com/professional-services/
>>> <http://www.rsyslog.com/professional-services/>
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> <https://twitter.com/rgerhards>
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>>> if you DON'T LIKE THAT.
>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>>> if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 27, 2023, 6:15 AM

Post #8 of 9 (395 views)

Permalink

Think of different inputs similarily to different ports on a server. If
you have only your httpd listening on TCP/80 there will be nothing to
process your mail sent to TCP/25.

Same here - if your rsyslogd listens exclusively with imrelp, there are
no other inputs.

On 27.02.2023 15:11, Tomas Bekecs Zvarillo via rsyslog wrote:
> To clarify this issue more. If I use imrelp on the server side, only data
> which will be sent and proceed are through omrelp ? I'm asking because
> processing where client is using omfwd and server have imptcp is working.
> Tests via logger are working on imptcp, imtcp modules, but not in imrelp
> module
>
> On Mon, Feb 27, 2023 at 2:47 PM Mariusz Kruk via rsyslog <
> rsyslog@lists.adiscon.com> wrote:
>
>> Well, logger sends where you tell him to send (either local socket or to
>> the specified "plain syslog" TCP/UDP destination) whereas rsyslogd will
>> listen on whatver inputs you specify in your config.
>>
>> So if you specify _only_ RELP inputs, you won't be able to send data any
>> other way.
>>
>> On 27.02.2023 14:40, Jozef Zajac via rsyslog wrote:
>>> After additional testing seems that configuration is correct.
>>> Messages were processed correctly when we send them via omrelp. Basic
>>> testing with logger was not successful.
>>> It mean that if we want use imrelp then also client has to send
>>> messages via omrelp? As we were not able process messages via logger
>>> or omfwd it look so.
>>>
>>> Best Regards,
>>> Jozef
>>> ______________________________________________________________
>>>> Od: "Rainer Gerhards via rsyslog" <rsyslog@lists.adiscon.com>
>>>> Komu: "rsyslog-users" <rsyslog@lists.adiscon.com>
>>>> Dátum: 24.02.2023 18:25
>>>> Predmet: Re: [rsyslog] imrelp - no messages processed
>>>>
>>>> CC: <rgerhards@hq.adiscon.com>
>>> also: do you send a proper RELP greeting via telnet? If not, this is
>>> the reason the connection is closed.
>>>
>>> Rainer
>>> El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
>>> (<rsyslog@lists.adiscon.com>) escribió:
>>>> what is the rest of your config? what you have shown is the config
>>> to receive
>>>> logs, but not any instructions to rsyslog to write logs out.
>>>>
>>>> David Lang
>>>>
>>>> On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
>>>>
>>>>> Date: Fri, 24 Feb 2023 15:41:42 +0100
>>>>> From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
>>>>> To: rsyslog@lists.adiscon.com
>>>>> Cc: Jozef Zajac <zajac.jozko@centrum.sk>
>>>>> Subject: [rsyslog] imrelp - no messages processed
>>>>>
>>>>> Hi everyone,
>>>>>
>>>>>
>>>>> I'm trying to put rsyslog into a docker container with the imrelp
>>> module.
>>>>> Setup is quite easy:
>>>>>
>>>>>
>>>>> rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
>>>>> rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
>>>>> port="2514" maxDataSize="10k" keepAlive="on")
>>>>>
>>>>>
>>>>> Unfortunately, there are no logs, but service looks fine. Logger
>>> is working
>>>>> with UDP (imudp module) but not in imrelp tcp. When I tried the
>>> ptcp module,
>>>>> logging worked fine.
>>>>>
>>>>>
>>>>> Setup:
>>>>> Ubuntu - 22.04 LTS, 5.15.0-56-generic
>>>>> docker version
>>>>> Client: Docker Engine - Community
>>>>> Version: 23.0.1
>>>>> API version: 1.42
>>>>> Go version: go1.19.5
>>>>> Git commit: a5ee5b1
>>>>> Built: Thu Feb 9 19:47:01 2023
>>>>> OS/Arch: linux/amd64
>>>>> Context: default
>>>>>
>>>>>
>>>>> Server: Docker Engine - Community
>>>>> Engine:
>>>>> Version: 23.0.1
>>>>> API version: 1.42 (minimum version 1.12)
>>>>> Go version: go1.19.5
>>>>> Git commit: bc3805a
>>>>> Built: Thu Feb 9 19:47:01 2023
>>>>> OS/Arch: linux/amd64
>>>>> Experimental: false
>>>>> containerd:
>>>>> Version: 1.6.18
>>>>> GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
>>>>> runc:
>>>>> Version: 1.1.4
>>>>> GitCommit: v1.1.4-0-g5fd4c4d
>>>>> docker-init:
>>>>> Version: 0.19.0
>>>>> GitCommit: de40ad0
>>>>>
>>>>>
>>>>> rsyslog - 8.2302
>>>>> rsyslog-relp - 8.2302
>>>>> librelp0 - 1.11.0
>>>>>
>>>>>
>>>>> When I try to connect to imrelp with telnet and close the session,
>>> I receive
>>>>> this error:
>>>>>
>>>>> v8.2302 (docker)
>>>>> syslog.err rsyslogd: imrelp[2514]: error 'server closed relp
>>> session, session
>>>>> broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' -
>>> input may not
>>>>> work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353
>>> <https://www.rsyslog.com/e/2353> ]
>>>>> v8.1901 (no docker)
>>>>> syslog.err rsyslogd: imrelp[514]: error 'server closed relp
>>> session, session
>>>>> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
>>> input may not
>>>>> work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353
>>> <https://www.rsyslog.com/e/2353> ]
>>>>> v8.2112 (no docker)
>>>>> syslog.err syslogd: imrelp[514]: error 'server closed relp
>>> session, session
>>>>> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
>>> input may not
>>>>> work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353
>>> <https://www.rsyslog.com/e/2353> ]
>>>>>
>>>>> When I ran rsyslog in debug mode, nothing unusual showed up.
>>>>> (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
>>>>>
>>>>>
>>>>>
>>>>> Is there something that I'm missing on this basic setup ?
>>>>>
>>>>>
>>>>> Thank you for any advice
>>>>>
>>>>>
>>>>> Best regards,
>>>>>
>>>>>
>>>>> Tomas Bekecs
>>>>>
>>>>> _______________________________________________
>>>>> rsyslog mailing list
>>>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>> http://www.rsyslog.com/professional-services/
>>> <http://www.rsyslog.com/professional-services/>
>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> <https://twitter.com/rgerhards>
>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of
>>>>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>>> you DON'T
>>>>> LIKE THAT.
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>> http://www.rsyslog.com/professional-services/
>>> <http://www.rsyslog.com/professional-services/>
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> <https://twitter.com/rgerhards>
>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>>> if you DON'T LIKE THAT.
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
>>> http://www.rsyslog.com/professional-services/
>>> <http://www.rsyslog.com/professional-services/>
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> <https://twitter.com/rgerhards>
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>>> if you DON'T LIKE THAT.
>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>>> if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: imrelp - no messages processed [ In reply to ]

rsyslog at lists

Feb 27, 2023, 7:20 AM

Post #9 of 9 (395 views)

Permalink

Everything is clear now. Thank you for explanations

On Mon, Feb 27, 2023 at 3:16 PM Mariusz Kruk via rsyslog <
rsyslog@lists.adiscon.com> wrote:

> Think of different inputs similarily to different ports on a server. If
> you have only your httpd listening on TCP/80 there will be nothing to
> process your mail sent to TCP/25.
>
> Same here - if your rsyslogd listens exclusively with imrelp, there are
> no other inputs.
>
>
>
> On 27.02.2023 15:11, Tomas Bekecs Zvarillo via rsyslog wrote:
> > To clarify this issue more. If I use imrelp on the server side, only data
> > which will be sent and proceed are through omrelp ? I'm asking because
> > processing where client is using omfwd and server have imptcp is working.
> > Tests via logger are working on imptcp, imtcp modules, but not in imrelp
> > module
> >
> > On Mon, Feb 27, 2023 at 2:47 PM Mariusz Kruk via rsyslog <
> > rsyslog@lists.adiscon.com> wrote:
> >
> >> Well, logger sends where you tell him to send (either local socket or to
> >> the specified "plain syslog" TCP/UDP destination) whereas rsyslogd will
> >> listen on whatver inputs you specify in your config.
> >>
> >> So if you specify _only_ RELP inputs, you won't be able to send data any
> >> other way.
> >>
> >> On 27.02.2023 14:40, Jozef Zajac via rsyslog wrote:
> >>> After additional testing seems that configuration is correct.
> >>> Messages were processed correctly when we send them via omrelp. Basic
> >>> testing with logger was not successful.
> >>> It mean that if we want use imrelp then also client has to send
> >>> messages via omrelp? As we were not able process messages via logger
> >>> or omfwd it look so.
> >>>
> >>> Best Regards,
> >>> Jozef
> >>> ______________________________________________________________
> >>>> Od: "Rainer Gerhards via rsyslog" <rsyslog@lists.adiscon.com>
> >>>> Komu: "rsyslog-users" <rsyslog@lists.adiscon.com>
> >>>> Dátum: 24.02.2023 18:25
> >>>> Predmet: Re: [rsyslog] imrelp - no messages processed
> >>>>
> >>>> CC: <rgerhards@hq.adiscon.com>
> >>> also: do you send a proper RELP greeting via telnet? If not, this is
> >>> the reason the connection is closed.
> >>>
> >>> Rainer
> >>> El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
> >>> (<rsyslog@lists.adiscon.com>) escribió:
> >>>> what is the rest of your config? what you have shown is the config
> >>> to receive
> >>>> logs, but not any instructions to rsyslog to write logs out.
> >>>>
> >>>> David Lang
> >>>>
> >>>> On Fri, 24 Feb 2023, Jozef Zajac via rsyslog wrote:
> >>>>
> >>>>> Date: Fri, 24 Feb 2023 15:41:42 +0100
> >>>>> From: Jozef Zajac via rsyslog <rsyslog@lists.adiscon.com>
> >>>>> To: rsyslog@lists.adiscon.com
> >>>>> Cc: Jozef Zajac <zajac.jozko@centrum.sk>
> >>>>> Subject: [rsyslog] imrelp - no messages processed
> >>>>>
> >>>>> Hi everyone,
> >>>>>
> >>>>>
> >>>>> I'm trying to put rsyslog into a docker container with the imrelp
> >>> module.
> >>>>> Setup is quite easy:
> >>>>>
> >>>>>
> >>>>> rsyslog_docker_global/03-modules.conf:2:module(load="imrelp")
> >>>>> rsyslog_docker_lin/rsyslog.d/11-input-tcp.conf:1:input(type="imrelp"
> >>>>> port="2514" maxDataSize="10k" keepAlive="on")
> >>>>>
> >>>>>
> >>>>> Unfortunately, there are no logs, but service looks fine. Logger
> >>> is working
> >>>>> with UDP (imudp module) but not in imrelp tcp. When I tried the
> >>> ptcp module,
> >>>>> logging worked fine.
> >>>>>
> >>>>>
> >>>>> Setup:
> >>>>> Ubuntu - 22.04 LTS, 5.15.0-56-generic
> >>>>> docker version
> >>>>> Client: Docker Engine - Community
> >>>>> Version: 23.0.1
> >>>>> API version: 1.42
> >>>>> Go version: go1.19.5
> >>>>> Git commit: a5ee5b1
> >>>>> Built: Thu Feb 9 19:47:01 2023
> >>>>> OS/Arch: linux/amd64
> >>>>> Context: default
> >>>>>
> >>>>>
> >>>>> Server: Docker Engine - Community
> >>>>> Engine:
> >>>>> Version: 23.0.1
> >>>>> API version: 1.42 (minimum version 1.12)
> >>>>> Go version: go1.19.5
> >>>>> Git commit: bc3805a
> >>>>> Built: Thu Feb 9 19:47:01 2023
> >>>>> OS/Arch: linux/amd64
> >>>>> Experimental: false
> >>>>> containerd:
> >>>>> Version: 1.6.18
> >>>>> GitCommit: 2456e983eb9e37e47538f59ea18f2043c9a73640
> >>>>> runc:
> >>>>> Version: 1.1.4
> >>>>> GitCommit: v1.1.4-0-g5fd4c4d
> >>>>> docker-init:
> >>>>> Version: 0.19.0
> >>>>> GitCommit: de40ad0
> >>>>>
> >>>>>
> >>>>> rsyslog - 8.2302
> >>>>> rsyslog-relp - 8.2302
> >>>>> librelp0 - 1.11.0
> >>>>>
> >>>>>
> >>>>> When I try to connect to imrelp with telnet and close the session,
> >>> I receive
> >>>>> this error:
> >>>>>
> >>>>> v8.2302 (docker)
> >>>>> syslog.err rsyslogd: imrelp[2514]: error 'server closed relp
> >>> session, session
> >>>>> broken', object 'lstn 2514: conn to clt127.0.0.1/localhost' -
> >>> input may not
> >>>>> work as intended [v8.2302.0 try https://www.rsyslog.com/e/2353
> >>> <https://www.rsyslog.com/e/2353> ]
> >>>>> v8.1901 (no docker)
> >>>>> syslog.err rsyslogd: imrelp[514]: error 'server closed relp
> >>> session, session
> >>>>> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
> >>> input may not
> >>>>> work as intended [v8.1901.0 try https://www.rsyslog.com/e/2353
> >>> <https://www.rsyslog.com/e/2353> ]
> >>>>> v8.2112 (no docker)
> >>>>> syslog.err syslogd: imrelp[514]: error 'server closed relp
> >>> session, session
> >>>>> broken', object 'lstn 514: conn to clt 127.0.0.1/localhost' -
> >>> input may not
> >>>>> work as intended [v8.2112.0 try https://www.rsyslog.com/e/2353
> >>> <https://www.rsyslog.com/e/2353> ]
> >>>>>
> >>>>> When I ran rsyslog in debug mode, nothing unusual showed up.
> >>>>> (/usr/sbin/rsyslogd -i /var/run/syslog.pid -f /etc/rsyslog.conf -dn)
> >>>>>
> >>>>>
> >>>>>
> >>>>> Is there something that I'm missing on this basic setup ?
> >>>>>
> >>>>>
> >>>>> Thank you for any advice
> >>>>>
> >>>>>
> >>>>> Best regards,
> >>>>>
> >>>>>
> >>>>> Tomas Bekecs
> >>>>>
> >>>>> _______________________________________________
> >>>>> rsyslog mailing list
> >>>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> >>>>> http://www.rsyslog.com/professional-services/
> >>> <http://www.rsyslog.com/professional-services/>
> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>> <https://twitter.com/rgerhards>
> >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >>> myriad of
> >>>>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
> >>> you DON'T
> >>>>> LIKE THAT.
> >>>> _______________________________________________
> >>>> rsyslog mailing list
> >>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> >>>> http://www.rsyslog.com/professional-services/
> >>> <http://www.rsyslog.com/professional-services/>
> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>> <https://twitter.com/rgerhards>
> >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> >>> if you DON'T LIKE THAT.
> >>> _______________________________________________
> >>> rsyslog mailing list
> >>> https://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> <https://lists.adiscon.net/mailman/listinfo/rsyslog>
> >>> http://www.rsyslog.com/professional-services/
> >>> <http://www.rsyslog.com/professional-services/>
> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>> <https://twitter.com/rgerhards>
> >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> >>> if you DON'T LIKE THAT.
> >>>
> >>> _______________________________________________
> >>> rsyslog mailing list
> >>> https://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> http://www.rsyslog.com/professional-services/
> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> >>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> >>> if you DON'T LIKE THAT.
> >> _______________________________________________
> >> rsyslog mailing list
> >> https://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> >> DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.