message modification modules: why run in direct (queue) mode?
Message modificaton modules modify the message object, so the next actions can process the modified message. However, if the action that invokes the message modification module runs on a real queue (anything other than queue.type=”direct”), the message object is actually duplicated, and done so only for executing the action. In other words, the duplicated message object is immediately destroyed after the action completes. That means the modification made by the module will never be visible by anyone else.
So never run a message modification module on a non-direct queue. Message modification modules usually start with the letters “mm” (as in “mmjsonparse”).
Note that this is not a bug: rsyslog’s design is generic, and for most other actions the duplication of message is necessary in many cases. The config parser detects this kind of problems, but does not auto-correct it as the issue points to a potentially larger issue.
rsyslog error 2357
Warning parsing config file.
This unfortunately is a pretty generic error code which is emitted when there is a problem understanding the configuration files. The main configuration file is usually /etc/rsyslog.conf and it may include other configuration files. The error message names the file and the approximate location of the error.
The error text should describe what needs to be fixed. If that does not help, it may make sense to check out rsyslog support options.
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 9
Indicates a (config) validation run, processing not carried out.
This is an expected code for config validation runs (those with -N<nbr> on the command line). It just indicates why rsyslog did not do a full startup.
rsyslog error 8
This is a trick for the debuging system – it means no iRet is provided
rsyslog error 7
Implementation is missing (probably internal error or lazyness ;))
rsyslog error 6
Memory allocation failed
This usually means that your system ran out of memory. This may be caused by queue sizes to be configured too high. Use impstats to gather more insight into ressource allocation.
rsyslog error 50
Size of this buffer is too small
The caller provided a buffer, but the called function sees the size of this buffer is too small – operation not carried out.
rsyslog error 3005
An digit was expected, but none found (mostly parsing)
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3004
An expected trailing quote is missing
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
rsyslog error 3003
Invalid config command
This error occurs when either an invalid configuration command is part of rsyslog.con or when the command is valid, but resides in a not-yet-loaded plugin.
To use commands provided by plugins, the plugin must be loaded first (via $ModLoad). Only after that the command can be used.
This error may also be caused by a module load failure. Be sure to check error messages before this one, they may point you into the right direction. Please note that this message should be followed by another one which tells you on which line of rsyslog.conf the problem occurred.
Sample Data:
2008-06-27T12:29:44.828434+02:00 machine.example.net rsyslogd-3003:invalid or yet-unknown config file command – have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
This is a stub entry: If you have questions please post a comment or visit the github issue tracker.