rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

Author : Adiscon Support

How to check if config variables are used?

Adiscon SupportFAQ, ,

Sometimes you might wonder, if the configuration you created is really used. At least parts of it. This could really happen in a lot of situations. Currently, the config format is changed a lot. This forces users who want to use the new format to use a mixed mode of old and new config style. And this is where a lot of confusion can occur, which results in not properly set config variables. In fact, you just need to create some consistency in the configuration. Most output modules are already updated. If you want to use the new format, you cannot use some old config directives and use some new config directives at the same time. The old ones will be simply ignored then. Instead the default values will be used. A very common case is with queues and this is what I will use for my example. I will show, how you can identify if configuration directives are used correctly. We will use the debug log for this. The rsyslog version I will use is the 6.3.12 beta. In this version, the main message queue still needs to be configured with the old config directives, whereas action queues already support the new config directives. You can enable debug mode for rsyslog with the following commands in a terminal:

export RSYSLOG_DEBUGLOG="/path/to/debuglog" export RSYSLOG_DEBUG="Debug"

You can now start rsyslog on the same command line with:

rsyslogd -c6

You will usually see the debug output in that same terminal, as rsyslog runs in the foreground. That should now just serve as a indicator, that the debug output works. Now here is the config snippet I used:

$ActionQueueType LinkedList $ActionQueueSize 2000000 $ActionQueueTimeoutEnqueue 0 $ActionQueueDequeueBatchSize 400 *.* action(type="omfwd" target="10.10.10.12" port="514" protocol="udp")

As you can see, we configured the action queue with some custom variables in the old fashion, basically the action queue and the action itself with the new style. If you create a new debug file now and review it, search for “action 1” in this case. You should see the following. This screenshot is a excerpt of the debug log. I marked several positions. The green circles show, that the action parameters have been used correctly. The red circles show two of the action queues parameters, where the defaults have been used. This is just a example on how to identify, if your configuration was loaded successfully.

rsyslog 6.2.2 (v6-stable) released

Adiscon SupportNews, Release Announcement, , , , ,

This is a bug-fixing release. Updating is recommended for users of the v6-stable branch. New users please note that in order to build this release, libestr, libee and optionally liblognorm (for mmnormalize) is required.

For more information about the fixes, please refer to the ChangeLog.

ChangeLog:

http://www.rsyslog.com/changelog-for-6-2-2-v6-stable/

Download:

http://www.rsyslog.com/rsyslog-6-2-2-v6-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 6.2.2 (v6-stable)

Adiscon SupportChangelog, , , , ,

Version 6.2.2  [v6-stable], 2012-06-13

  • build system improvements and spec file templates
    Thanks to Abby Edwards for providing these enhancements
  • bugfix: disk queue was not persisted on shutdown, regression of fix to
    http://bugzilla.adiscon.com/show_bug.cgi?id=299
    The new code also handles the case of shutdown of blocking light and full delayable sources somewhat smarter and permits, assuming sufficient timouts, to persist message up to the max queue capacity. Also some nits in debug instrumentation have been fixed.
  • bugfix: –enable-smcustbindcdr configure directive did not work
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=330
    Thanks to Ultrabug for the patch.
  • add small delay (50ms) after sending shutdown message. There seem to be cases where the shutdown message is otherwise not processed, not even on an idle system.
    Thanks to Marcin for bringing this problem up.
  • support for resolving huge groups
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=310
    Thanks to Alec Warner for the patch
  • bugfix: potential hang due to mutex deadlock
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=316
    Thanks to Andreas Piesk for reporting&analyzing this bug as well as providing patches and other help in resolving it.
  • bugfix: property PROCID empty instead of proper nilvalue if not present
    If it is not present, it must have the nilvalue “-” as of RFC5424
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=332
    Thanks to John N for reporting this issue.
  • bugfix: did not compile under solaris due to $uptime property code
    For the time being, $uptime is not supported on Solaris
  • bugfix: “last message repeated n times” message was missing hostname
    Thanks to Zdenek Salvet for finding this bug and to Bodik for reporting

Changelog for 5.8.12 (v5-stable)

Adiscon SupportChangelog, , , , ,

Version 5.8.12  [V5-stable] 2012-06-06

  • add small delay (50ms) after sending shutdown message
    There seem to be cases where the shutdown message is otherwise not processed, not even on an idle system.
    Thanks to Marcin for bringing this problem up.
  • support for resolving huge groups
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=310
    Thanks to Alec Warner for the patch
  • bugfix: delayble source could block action queue, even if there was a disk queue associated with it. The root cause of this problem was that it makes no sense to delay messages once they arrive in the action queue – the “input” that is being held in that case is the main queue worker, what makes no sense.
    Thanks to Marcin for alerting us on this problem and providing instructions to reproduce it.
  • bugfix: disk queue was not persisted on shutdown, regression of fix to
    http://bugzilla.adiscon.com/show_bug.cgi?id=299
    The new code also handles the case of shutdown of blocking light and full delayable sources somewhat smarter and permits, assuming sufficient timeouts, to persist message up to the max queue capacity. Also some nits in debug instrumentation have been fixed.
  • bugfix/omudpspoof: problems, including abort, happend when run on multiple threads. Root cause is that libnet is not thread-safe. omudpspoof now guards libnet calls with their own mutex.
  • bugfix: if debug message could end up in log file when forking if rsyslog was set to auto-background (thus fork, the default) and debug mode to stdout was enabled, debug messages ended up in the first log file opened. Currently, stdout logging is completely disabled in forking mode (but writing to the debug log file is still possible). This is a change in behaviour, which is under review. If it causes problems to you, please let us know.
    Thanks to Tomas Heinrich for the patch.
  • bugfix/tcpflood: sending small test files did not work correctly
  • bugfix: potential hang due to mutex deadlock
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=316
    Thanks to Andreas Piesk for reporting&analyzing this bug as well as providing patches and other help in resolving it.
  • bugfix: property PROCID empty instead of proper nilvalue if not present
    If it is not present, it must have the nilvalue “-” as of RFC5424
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=332
    Thanks to John N for reporting this issue.
Scroll to top