rsyslog

No ruleset name as specified where one was needed.

This error happens if no ruleset is specified when a plugin needs one to function properly. This usually happens with omruleset, which needs to have the name of the ruleset to submit to. Note that in recent versions of rsyslog, omruleset has been superseded by the better “call” statement.

Some versions of mmnormalize also emit this error. In that case, what actually is missing is the normalization (sample) database.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

A required ruleset could not be found! Please check your configuration.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

We were instructed to create a new ruleset queue, but one already exists.

The user tries to specify multiple ruleset queues, which is impossible. The $rulesetcreatemainqueue parameter is given multiple times for the same ruleset. Remove all but one.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Thread was forced to terminate by bShallShutdown, a state, not an error.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Error initializing libnet, e.g. because not running as root.

This happens with omudpspoof, usually when privileges have been dropped, what is not possible with this module. See omudpspoof.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Some problems with handling the Solaris door functionality.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Error opening or reading the kernel log socket (primarily solaris).

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Remote peer closed connection (information, no error).

The remote server terminated the connection. This is an informational message. It can be turned off by the XXXX configuration directive.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Provided (raw) MSG is empty.

This occurs with omudpspoof. This module needs a template specifying the source system name (IP address) to be spoofed. However, that directive was not specified. Check the omudpspoof documentation for a working sample.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

Variable not found.

A required variable was not found. This is currently used to flag two conditions:

either an RainerScript scripting engine variable was not found,

or a property name (e.g. when used inside a template) was not found.

One reason for this error may be a forgotten filter.

For example, if the config file contains only

:ommysql:…(more params)

This obviously is meant as an action that shall be executed in all cases. However, in rsyslog an action must be preceded by the filter telling the engine when to execute the action. Thus, rsyslog interprets the first column as a property-based filter, and with such a filter, “ommysql” would be the message property name on which the filter operates. Obviously, there exist no “ommysql” message property, and so error 2142 is generated by the configuration parser.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.