rsyslog

The rocket-fast system for log processing

rsyslog error 2006

By adisconteamPosted on Posted in UncategorizedTagged No Comments on rsyslog error 2006

Action has disabled itself.

This is a follow-up error. Additional error messages should appear in front of this message.

What it means is that an action had a failure that caused it to disable itself. If an action is disabled, it will no longer be executed. This event will most probably happen when the configuration file is being processed, right before actual message processing begins. However, the 2006 status code may be issued at any time.

When and why it is issued is purely up to the output plugin in question. In general, an action should disable itself only if there is no chance (not even a remote one) that action processing can correctly continue. For example, omsnmp disables itself if it can not initialize the net-snmp library, in which case no further processing is possible.

A disable action will remain disabled until either rsyslogd is restarted or (for older releases) a restart-type HUP is issued (which mimics a restart and thus is the same thing).

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

rsyslog error 2004

By adisconteamPosted on Posted in UncategorizedTagged No Comments on rsyslog error 2004

Do not create an entry for (whatever) – not necessary an error.

Can happen if an ACL is to be added for tcp and udp syslog, a DNS name is used but the DNS name is non-resolvable or does not resolve into usable entries. It is best to double-check the permitted peers definitions for typos.

This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

rsyslog error 2007

By Rainer GerhardsPosted on Posted in UncategorizedTagged 4 Comments on rsyslog error 2007

What does it mean?

This is a generic error message that unfortunately can happen in a number of cases.

In practice, it is often associated with suspension of actions. Then it comes with a text like

action “action 17” suspended

The number behind action changes.

How to solve it?

A frequent case for this error message on Debian-based distributions (like raspbian) is that rsyslog.conf contains the instruction to write to the xconsole pipe, but this pipe is never read. If so, you can simply delete these lines to remove the error message. These lines are usually found at the end of rsyslog.conf.

For other error message, it probably is a good idea to check rsyslog’s issue tracker at github and file a new issue if you can’t find a related case.

Note: we try to keep this page update if we see other frequent causes of this error.

librelp 1.2.16

By Rainer GerhardsPosted on Posted in 1.2.16, APITagged ,

librelp 1.2.16 [download]

This new release of librelp provides API changes that allow better handling of oversize messages, as well as defining the listener interface. In addition, a few bugfixes for memory leaks and several minor issues are included.

For more details, please take a look at the changelog below.

———————————————————————-
– API changes
  * add new API: relpSrvSetOversizeMode()
    This permits to tell librelp how to handle oversize messages.
    Traditionally (and now default), this aborts the session. We now
    added an option to truncate the message instead.
    Also, in case of session abort a descriptive error message is
    emitted. This did not happen previously and caused confusion.
    closes https://github.com/rsyslog/librelp/issues/81
  * add new API: relpSrvSetLstnAddr()
    It permits to set the listen address inside the relp server.
    If not called, the server will bind to all interfaces. 
    Thanks to github user perlei for contributing it.
– support additional hashes for fingerprint mode
  old-style SHA1 is used automatically
  Thanks to github user briaeros for the patch.
  see also https://github.com/rsyslog/librelp/pull/55
– bugfix: potential memory leak
  This is very unlikely to occur in practice. Memory can be leaked
  when TLS initialization fails when the client tries to connect
  to the server. However, if this actually happens, it can happen
  frequently and so accumulate to a large leak.
  No report of such occurence from practice.
  Detected by Coverity Scan, CID 266008.
– bugfix: memory leak on protocol error
  Receiving relp frames are not correctly deallocated while handling
  protocol errors resulting in memory leak of dirty pages.
  Thanks to github user gleentea for the patch.
  see also https://github.com/rsyslog/librelp/issues/59
  closes https://github.com/rsyslog/librelp/issues/60
– fixed a couple of minor issues:
  * fix memory leak when relp frame construction fails
    detected by clang static analyzer
  * removed unnecessary code
    detected by clang static analyzer
  * fix memory leak
    This leaks occurs if the process is already totally out of memory,
    a situation that is very rare and will also cuase other troubles.
    So the practical relevance of this patch looks rather slim.
    Detected by clang static analyzer.
  * fix memory leak on relpSrvRun() error
    this is kind of cosmetic, because it can only occur when the
    run fails, which usually should lead to termination of the
    calling application
    deteced by Coverity Scan, CID 266016
  * fix memory leak on relp listener construction error
    detected by Coverity Scan, CID 266014, 266015
  * also resolved all other issues reported by Coverity scan
– CI
  * added native testbench (formerly used rsyslog for testing)
  * added additional compile tests


sha256sum: 0c235dd2a01060ad5e64438879b31ae64e7640d0e262aa1a287a2dd9bc60fd53

RSyslog Windows Agent 5.0 Released

By friedlPosted on Posted in Release AnnouncementTagged , , , , ,

Release Date: 2018-04-11

Build-IDs: Service 5.0.0.185, Client 5.0.0.263

Features

  • File Monitor: Added new options “Process rest of file as one message” and Read  Filebuffer size for better regex message separator handling.
  • Syslog Action: Added support for multiple syslog servers (Load balancing)
  • Syslog Action: Backup Syslog Server is now tried on connect as well. Before, the backup server was only used when an existing connection to the primary server interrupted.
  • Core Engine: Enhanced debug output for network errors.
  • LogNorm Action: Updated Action to support liblognorm v2 rulebases.

Bugfixes

  • Property Engine: Fixed daylight handling when using RFC3339 string conversion. Daylight was incorrectly always applied.
  • Property Engine: Fixed dynamic properties conversion when using xml output. This bug caused some properties to be missing when sending them by SETP protocol or using Syslog Cache mode.
  • Configuration reload: Fixed missing SNMP Mibtree after configuration reload.

You can download Free Trial Version of RSyslog Windows Agent.

rsyslog 8.34.0 (v8-stable) released

By friedlPosted on Posted in News, Release Announcement, UncategorizedTagged , , , , ,

Today, we release rsyslog 8.34.0. Most notably is the large refactoring of the imfile module as well as the new module mmkubernetes (contributed). Additionaly, a lot of improvements and fixes have been added to the current release, too many to list them all. So please take a look at the changelog for all the details.

ChangeLog:
Scroll to top