MonitorWare Knowledge Base

Hi,

I'm trying to configure rsyslog-3.21.9-2.fc10 on CentOS 5 based on http://www.rsyslog.com/doc-rsyslog_tls.html. rsyslog v3.21.9 was installed using an rpm. It looks like /usr/lib/rsyslog/lmnsd_gtls.so is missing. Any idea? Thanks.

Here's the /etc/rsyslog.conf.

Code: Select all

#### MODULES ####
$ModLoad imuxsock.so    # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so      # provides kernel logging support (previously done by rklogd)
$ModLoad imtcp.so

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /etc/rsyslog/ca.pem
$DefaultNetstreamDriverCertFile /etc/rsyslog/server.pem
$DefaultNetstreamDriverKeyFile /etc/rsyslog/key.pem

# Provides TCP syslog reception
$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated
$InputTCPServerRun 61514 # start up listener at port 61514

#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#### RULES ####
# rotate the log file for each host everyday.
$template DailyLogs,"/var/log/rsyslog/%HOSTNAME%-%$YEAR%-%$MONTH%-%$DAY%.log"

*.* ?DailyLogs


Here's part of the debug log.

Code: Select all

3890.257170000:main thread: Writing pidfile /var/run/syslogd.pid.
3890.257296000:main thread: rsyslog 3.21.9 - called init()
3890.257307000:main thread: Unloading non-static modules.
3890.257314000:main thread: module lmnet NOT unloaded because it still has a refcount of 3
3890.257320000:main thread: Clearing templates.
3890.257348000:main thread: cfline: '$ModLoad imuxsock.so    # provides support for local system logging (e.g. via logger command)'
3890.257359000:main thread: Requested to load module 'imuxsock.so'
3890.257366000:main thread: loading module '/usr/lib/rsyslog/imuxsock.so'
3890.257408000:main thread: imuxsock version 3.21.9 initializing
3890.257428000:main thread: module of type 0 being loaded.
3890.257436000:main thread: cfline: '$ModLoad imklog.so      # provides kernel logging support (previously done by rklogd)'
3890.257444000:main thread: Requested to load module 'imklog.so'
3890.257450000:main thread: loading module '/usr/lib/rsyslog/imklog.so'
3890.257524000:main thread: module of type 0 being loaded.
3890.257534000:main thread: cfline: '$ModLoad imtcp.so'
3890.257542000:main thread: Requested to load module 'imtcp.so'
3890.257549000:main thread: loading module '/usr/lib/rsyslog/imtcp.so'
3890.257591000:main thread: source file imtcp.c requested reference for module 'lmnet', reference count now 4
3890.257601000:main thread: caller requested object 'netstrm', not found (iRet -3003)
3890.257610000:main thread: Requested to load module 'lmnetstrms'
3890.257617000:main thread: loading module '/usr/lib/rsyslog/lmnetstrms.so'
3890.257660000:main thread: module of type 2 being loaded.
3890.257669000:main thread: source file imtcp.c requested reference for module 'lmnetstrms', reference count now 1
3890.257676000:main thread: caller requested object 'tcps_sess', not found (iRet -3003)
3890.257682000:main thread: Requested to load module 'lmtcpsrv'
3890.257689000:main thread: loading module '/usr/lib/rsyslog/lmtcpsrv.so'
3890.257733000:main thread: source file tcps_sess.c requested reference for module 'lmnetstrms', reference count now 2
3890.257743000:main thread: source file tcpsrv.c requested reference for module 'lmnet', reference count now 5
3890.257751000:main thread: source file tcpsrv.c requested reference for module 'lmnetstrms', reference count now 3
3890.257760000:main thread: module of type 2 being loaded.
3890.257767000:main thread: source file imtcp.c requested reference for module 'lmtcpsrv', reference count now 1
3890.257774000:main thread: source file imtcp.c requested reference for module 'lmtcpsrv', reference count now 2
3890.257792000:main thread: module of type 0 being loaded.
3890.257801000:main thread: cfline: '$DefaultNetstreamDriver gtls'
3890.257810000:main thread: cfline: '$DefaultNetstreamDriverCAFile /etc/rsyslog/ca.pem'
3890.257818000:main thread: cfline: '$DefaultNetstreamDriverCertFile /etc/rsyslog/server.pem'
3890.257827000:main thread: cfline: '$DefaultNetstreamDriverKeyFile /etc/rsyslog/key.pem'
3890.257839000:main thread: cfline: '$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode'
3890.257848000:main thread: cfline: '$InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated'
3890.257858000:main thread: cfline: '$InputTCPServerRun 61514 # start up listener at port 61514'
3890.257870000:main thread: caller requested object 'nsd_gtls', not found (iRet -3003)
3890.257876000:main thread: Requested to load module 'lmnsd_gtls'
3890.257883000:main thread: loading module '/usr/lib/rsyslog/lmnsd_gtls.so'
3890.257908000:main thread: Called LogError, msg: could not load module '/usr/lib/rsyslog/lmnsd_gtls.so', dlopen: /usr/lib/rsyslog/lmnsd_gtls.so: cannot ope$

3890.258007000:main thread: Called LogError, msg: error -2066 trying to add listener
3890.258053000:main thread: config line NOT successfully processed
3890.258062000:main thread: Called LogError, msg: the last error occured in /etc/rsyslog.conf, line 28
3890.258102000:main thread: cfline: '$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat'
3890.258118000:main thread: cfline: '$template DailyLogs,"/var/log/rsyslog/%HOSTNAME%-%$YEAR%-%$MONTH%-%$DAY%.log"'
3890.258141000:main thread: cfline: '*.* ?DailyLogs'
3890.258152000:main thread:  - traditional PRI filter


• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Indeed, it looks like the module is not there. Is it somewhere on your system?

I still cannot find it, but that's okay. I can still use stunnel to secure communication between the client and the server.

If I build from the source code, will lmnsd_gtls.so be created too?

It turns out that lmnsd_gtls.so is available in rsyslog-gnutls-3.21.9-2.fc10.i386.rpm, which requires several dependencies to be installed.

If you build from source, and use the proper configure switches, all required files will be generated.

Can you confirm that building rsyslog from source code gives me everything including lmnsd_gtls.so and that it doesn't ask for a particular version of any library that is not installed on CentOS out of the box? Thanks.

I really can't say more than what I said. you need the proper switches (see ./configure --help) and you need everything present on the system that the build requires (./configure tells you if something is missing). Then, it builds everything it needs. I unforutnately can not offer in-depth help with this. If you need that, you should consider purchasing a professional service package. An alternative might be to try ask the mailing list, which usually is quite helpful with such issues.

HTH
Rainer