MonitorWare Knowledge Base

I am installing rsyslog on a VM version of RH8. I installed & complied from source. I am getting the following message when I try to start rsyslog:

/etc/sysconfig/rsyslog: line 1: MySQL: command not found
/etc/sysconfig/rsyslog: line 14: 127.0.0.1,syslog,cacti,password: command not found

I search the whole drive & find MySQL nowhere.

When I try to use ommysql.so in the config file. I get a segment fault.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

ommyql.so is the right name, MySQL is a backward-compatible alias.

Please post your config file and the segfault.

Thanks,
Rainer

/etc/sysconfig/rsyslog: line 1: 17568 Segmentation fault $ModLoad /usr/local/lib/rsyslog/immark.so
/etc/sysconfig/rsyslog: line 2: 17569 Segmentation fault $ModLoad /usr/local/lib/rsyslog/imudp.so
/etc/sysconfig/rsyslog: line 3: 17570 Segmentation fault $ModLoad /usr/local/lib/rsyslog/imtcp.so
/etc/sysconfig/rsyslog: line 4: 17571 Segmentation fault $ModLoad /usr/local/lib/rsyslog/imuxsock.so
/etc/sysconfig/rsyslog: line 5: 17572 Segmentation fault $ModLoad /usr/local/lib/rsyslog/imklog.so
/etc/sysconfig/rsyslog: line 6: 17573 Segmentation fault $ModLoad /usr/local/lib/rsyslog/ommysql.so
/etc/sysconfig/rsyslog: line 19: 127.0.0.1,syslog,cacti,password: command not found

----------------/etc/sysconfig/rsyslog

$ModLoad /usr/local/lib/rsyslog/immark.so # provides --MARK-- message capability
$ModLoad /usr/local/lib/rsyslog/imudp.so # provides UDP syslog reception
$ModLoad /usr/local/lib/rsyslog/imtcp.so # provides TCP syslog reception and GSS-API (if compiled to support it)
$ModLoad /usr/local/lib/rsyslog/imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad /usr/local/lib/rsyslog/imklog.so # provides kernel logging support (previously done by rklogd)
$ModLoad /usr/local/lib/rsyslog/ommysql.so
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -rPortNumber Enables logging from remote machines. The listener will listen to the specified port.
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-m 0"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
*.* >localhost,syslog,cacti,password

Here's the logfile with the segfaults
imklog.so[16232]: segfault at 00000001 eip 00000001 esp bff04734 error 4
ommysql.so[16233]: segfault at 00000001 eip 00000001 esp bffc5ff4 error 4
immark.so[17474]: segfault at 00000001 eip 00000001 esp bfbd61d4 error 4
imudp.so[17475]: segfault at 00000001 eip 00000001 esp bfa47284 error 4
imtcp.so[17476]: segfault at 00000001 eip 00000001 esp bf882234 error 4
imuxsock.so[17477]: segfault at 00000001 eip 00000001 esp bfde4e14 error 4
imklog.so[17478]: segfault at 00000001 eip 00000001 esp bf97aeb4 error 4
ommysql.so[17479]: segfault at 00000001 eip 00000001 esp bfe73ea4 error 4
immark.so[17532]: segfault at 00000001 eip 00000001 esp bfe796b4 error 4
imudp.so[17533]: segfault at 00000001 eip 00000001 esp bfdf2e34 error 4
imtcp.so[17534]: segfault at 00000001 eip 00000001 esp bfbf5434 error 4
imuxsock.so[17535]: segfault at 00000001 eip 00000001 esp bff74fa4 error 4
imklog.so[17536]: segfault at 00000001 eip 00000001 esp bfa3b6e4 error 4
ommysql.so[17537]: segfault at 00000001 eip 00000001 esp bfc04434 error 4
immark.so[17568]: segfault at 00000001 eip 00000001 esp bf8e7124 error 4
imudp.so[17569]: segfault at 00000001 eip 00000001 esp bfc7acb4 error 4
imtcp.so[17570]: segfault at 00000001 eip 00000001 esp bff847c4 error 4
imuxsock.so[17571]: segfault at 00000001 eip 00000001 esp bfa8dac4 error 4
imklog.so[17572]: segfault at 00000001 eip 00000001 esp bfe2f664 error 4
ommysql.so[17573]: segfault at 00000001 eip 00000001 esp bfeb9ef4 error 4

are you using 3.11.1 or a v2 version?

oops... stop... You are in the wrong file (at least I guess so). The directives need to go into /etc/rsyslog.conf (again, just an educated guess).

It doesn't care. I can put the config on both places, and get the same result.
FC8 came with rsyslog initially, but didn't have anything for mysql. So I built it with mysql

Hi Shadetree,

first of all, F8 rsyslog has support for MySQL, it's just in a different package - rsyslog-mysql. So I guess the best thing to do would be to install those two packages.

/etc/rsyslog.conf holds all of the configuration directives and filters, most of the configuration goes here.
/etc/sysconfig/rsyslog holds only the commandline options via SYSLOGD_OPTIONS variable. Anything that can't be executed by the shell _shoudl not be here_.

The rsyslog version in F8 is 2.x.y, so if you use the official package, you won't need those $ModLoad directives except for MySQL.

And last note, if you install the official packages and the configuration files are modified, the new ones will be installed with a .rpmnew suffix.

I think I got that ironed out, but I cannot connect with mysql server.
I am getting the following error
rsyslogd:db error (2003): Can't connect to MySQL server on '127.0.0.1' (13)

umm... it looks like there either is no MySQL server is listening on 127.0.0.1 or your firewall settings prevent rsyslogd from reaching it...

Rainer

rsyslog is on the same device as the mysql server. I chenged the config to connect to localhost. Here's what I see when starting rsyslog

Feb 15 12:49:27 myserver rsyslogd: [origin software="rsyslogd" swVersion="1.19.11" x-pid="5283"][x-configInfo udpReception="Yes" udpPort="514" tcpReception="No" tcpPort="0"] restart
Feb 15 12:49:27 myserver rsyslogd:db error (2002): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)

(I can connect to mysql via the command line.)

OK. I've traded one problem for another......
Apparently FC8 was using ver 1.19.11. Thsi was not connecting to mysql. I've installed 3.11, and can connect to the mysql database.
Now I am unable to receive any messages from other devices.
When I start rsyslog I get the following message....
Starting system logger: Warning: compatibility modes < 3 are currently NOT supported - continuing...
dbg fl: (null)
[ OK ]

there is a backward compatibility doc in the doc set - e.g. right here on the site under the doc/status section. i guess some directives are missing and the doc has them.