rsyslog error 1001
Interface version mismatch, required missing.
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3010
The initialization of a fen instance failed (no details available).
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3009
The initialization of an inotify instance failed (no details available).
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3008
The creation of an object failed (no details available).
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3007
Invalid ip found where valid was expected.
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3006
Insufficient data, e.g. end of string during parsing.
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3002
Some value found, but at the last pos of string.
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3001
Truncation operation where too many chars should be truncated.
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3000
Generic failure
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
message modification modules: why run in direct (queue) mode?
Message modificaton modules modify the message object, so the next actions can process the modified message. However, if the action that invokes the message modification module runs on a real queue (anything other than queue.type=”direct”), the message object is actually duplicated, and done so only for executing the action. In other words, the duplicated message object is immediately destroyed after the action completes. That means the modification made by the module will never be visible by anyone else.
So never run a message modification module on a non-direct queue. Message modification modules usually start with the letters “mm” (as in “mmjsonparse”).
Note that this is not a bug: rsyslog’s design is generic, and for most other actions the duplication of message is necessary in many cases. The config parser detects this kind of problems, but does not auto-correct it as the issue points to a potentially larger issue.