MonitorWare Knowledge Base

I just installed rsyslog and logcon and am not getting any logs. Below is my rsyslog config and the errors I get when I start up rsyslogd.

Thanks,
Tim

/etc/rsyslog/rsyslog.conf: line 11: immark.so: command not found
/etc/rsyslog/rsyslog.conf: line 12: imudp.so: command not found
/etc/rsyslog/rsyslog.conf: line 13: imtcp.so: command not found
/etc/rsyslog/rsyslog.conf: line 14: imuxsock.so: command not found
/etc/rsyslog/rsyslog.conf: line 15: imklog.so: command not found
/etc/rsyslog/rsyslog.conf: line 17: kern.warning: command not found
/etc/rsyslog/rsyslog.conf: line 17: *.err: command not found
/etc/rsyslog/rsyslog.conf: line 17: authpriv.none: command not found
/etc/rsyslog/rsyslog.conf: line 18: kern.warning: command not found
/etc/rsyslog/rsyslog.conf: line 18: *.err: command not found
/etc/rsyslog/rsyslog.conf: line 18: authpriv.none: command not found
/etc/rsyslog/rsyslog.conf: line 18: /dev/xconsole: Permission denied
/etc/rsyslog/rsyslog.conf: line 19: *.emerg: command not found
/etc/rsyslog/rsyslog.conf: line 29: mail.*: command not found
/etc/rsyslog/rsyslog.conf: line 30: mail.info: command not found
/etc/rsyslog/rsyslog.conf: line 31: mail.warning: command not found
/etc/rsyslog/rsyslog.conf: line 32: mail.err: command not found
/etc/rsyslog/rsyslog.conf: line 38: news.crit: command not found
/etc/rsyslog/rsyslog.conf: line 39: news.err: command not found
/etc/rsyslog/rsyslog.conf: line 40: news.notice: command not found
/etc/rsyslog/rsyslog.conf: line 48: *.=warning: command not found
/etc/rsyslog/rsyslog.conf: line 48: *.=err: command not found
/etc/rsyslog/rsyslog.conf: line 49: *.crit: command not found
/etc/rsyslog/rsyslog.conf: line 54: rsyslog.conf: command not found
/etc/rsyslog/rsyslog.conf: line 54: mail.none: command not found
/etc/rsyslog/rsyslog.conf: line 54: news.none: command not found
/etc/rsyslog/rsyslog.conf: line 64: local0,local1.*: command not found
/etc/rsyslog/rsyslog.conf: line 65: local2,local3.*: command not found
/etc/rsyslog/rsyslog.conf: line 66: local4,local5.*: command not found
/etc/rsyslog/rsyslog.conf: line 67: local6,local7.*: command not found
/etc/rsyslog/rsyslog.conf: line 68: rsyslog.conf: command not found
Starting Rsyslo Warning: compatibility modes < 3 are currently NOT supported - continuing...

# /etc/syslog.conf - Configuration file for syslogd(8)
#
# For info about the format of this file, see "man syslog.conf".
#

#
#
# print most on tty10 and on the xconsole pipe
#

$ModLoad immark.so # provides --MARK-- message capability
$ModLoad imudp.so # provides UDP syslog reception
$ModLoad imtcp.so # provides TCP syslog reception and GSS-API (if compiled to support it)
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so # provides kernel logging support (previously done by rklogd)

kern.warning;*.err;authpriv.none /dev/tty10
kern.warning;*.err;authpriv.none |/dev/xconsole
*.emerg *

# enable this, if you want that root is informed
# immediately, e.g. of logins
#*.alert root


#
# all email-messages in one file
#
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err /var/log/mail.err

#
# all news-messages
#
# these files are rotated and examined by "news.daily"
news.crit -/var/log/news/news.crit
news.err -/var/log/news/news.err
news.notice -/var/log/news/news.notice
# enable this, if you want to keep all news messages
# in one file
#news.* -/var/log/news.all

#
# Warnings in one file
#
*.=warning;*.=err -/var/log/warn
*.crit /var/log/warn

#
# save the rest in one file
#
*.*;mail.none;news.none -/var/log/messages

#
# enable this, if you want to keep all messages
# in one file
#*.* -/var/log/allmessages

#
# Some foreign boot scripts require local7
#
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages

How do you start rsyslogd? It looks like the config file was executed by the shell...

this is running on suse 10.3 btw

#! /bin/sh
#
#
# Author Tim Wolak
#
# /etc/init.d/rsyslog
#
# link to /usr/local/sbin/rsyslogd
#
#
# Check for missing binaries
RSYS_BIN=/usr/local/sbin/rsyslogd
test -x $RSYS_BIN || { echo "$RSYS_BIN not installed";
if [ "$1" = "stop" ]; then exit 0;
else exit 5; fi; }

# Check for existence of needed config file and read it
RSYS_CONFIG=/etc/rsyslog/rsyslog.conf
test -r $RSYS_CONFIG || { echo "$RSYS_CONFIG not existing";
if [ "$1" = "stop" ]; then exit 0;
else exit 6; fi; }

# Read config
. $RSYS_CONFIG
# Load the rc.status script for this service.
. /etc/rc.status

# Reset status of this service
rc_reset

case "$1" in
start)
echo -n "Starting Rsyslo "
## Start daemon with startproc(8). If this fails
## the return value is set appropriately by startproc.
startproc $RSYS_BIN

# Remember status and be verbose
rc_status -v
;;
stop)
echo -n "Shutting down Rsyslog "
## Stop daemon with killproc(8) and if this fails
## killproc sets the return value according to LSB.

killproc -TERM $RSYS_BIN

# Remember status and be verbose
rc_status -v
;;
restart)
## Stop the service and regardless of whether it was
## running or not, start it again.
$0 stop
$0 start

# Remember status and be quiet
rc_status
;;
reload)
# If it supports signaling:
echo -n "Reload service bar "
killproc -HUP $RSYS_BIN
#touch /var/run/RSYS.pid
rc_status -v

## Otherwise if it does not support reload:
#rc_failed 3
#rc_status -v
;;
status)
echo -n "Checking for service Rsyslog "
## Check status with checkproc(8), if process is running
## checkproc will return with exit status 0.

# Return value is slightly different for the status command:
# 0 - service up and running
# 1 - service dead, but /var/run/ pid file exists
# 2 - service dead, but /var/lock/ lock file exists
# 3 - service not running (unused)
# 4 - service status unknown
# 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.)

# NOTE: checkproc returns LSB compliant status values.
checkproc $RSYS_BIN
# NOTE: rc_status knows that we called this init script with
# "status" option and adapts its messages accordingly.
rc_status -v
;;
*)
## If no parameters are given, print which are avaiable.
echo "Usage: $0 {start|stop|status|restart|reload}"
exit 1
;;
esac
/etc/init.d/rsyslog lines 32-95/95 (END)

Can anyone help?

I have to admit I don't understand the suse startup script I'll try to find someone who does. In the mean time it may be a good idea to post on such places like linuxquestions. As it looks, this is not a real rsyslog issue but one of which file needs to be placed where - at least I don't see anything else so far...

Sorry,
Rainer

thanks! I started rsyslogd manually and pointing it at the config file and it started fine, however I'm still not getting anything in logcon....

ok, that's good news. If I see correctly, the write database action is missing. I suggest this guide here:

http://www.rsyslog.com/doc-rsyslog_mysql.html

Note that it is for v2, so the $ModLoad's are not mentioned, but you need them for v3 (and you have them, so simply make sure you do not remove them). The essential thing you need is the

*.* >.....

line.

HTH Rainer

Thanks for the help! I got it, I was missing that line and I would bet that that startup script was missing -f to point to the config.

Can you possibly tell me where I can go to get better info on writing startup scripts?

Also if I want to have remote hosts log to this can I?

Thanks again!

Great that it works I also received some help on the original question. The

". $RSYS_CONFIG" seems to be wrong and must be removed.

It is also suggested to try out the rpms from

http://download.opensuse.org/repositories/home:/darix/

These should start fine, but are not 100% integrated into the distro.

Hopefully this is useful.

I unfortunately do not know anything about startup scripts. My best guess is that you should look in a SuSe-specific forum. I personally made good experience with the LinuxQuestions community, which was fast and helpful when I asked.

On remote hosts, that of course is possible If you are using v3, you need to configure the listener. See http://www.rsyslog.com/doc-v3compatibility.html and watch out for "-r option" (I assume you intend to use UDP as this is what most other hosts can handle).

Rainer