Problems with v7 and stop

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: rgerhards

Google Ads


Problems with v7 and stop

Postby canadaboy » Fri Oct 19, 2012 9:04 pm

So I have taken my old v5 config and thrown it on a test server with v7. I run my config check and I get a bunch of:

Code: Select all
# /usr/local/sbin/rsyslogd -f /etc/rsyslog.conf -N1
rsyslogd: version 7.1.11, config validation run (level 3), master config /etc/rsyslog.conf
rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

(btw: http://www.rsyslog.com/e/2307 has no content)

So, being a good boy who can follow instructions, I change over:

Code: Select all
#auth,authpriv.*                 /var/log/secure
#& ~
auth,authpriv.*                 /var/log/secure
& stop


But that does not make things happy at all!

Code: Select all
# /usr/local/sbin/rsyslogd -f /etc/rsyslog.conf -N1
rsyslogd: version 7.1.11, config validation run (level 3), master config /etc/rsyslog.conf
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 51: syntax error [try http://www.rsyslog.com/e/2207 ]
rsyslogd: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2207 ]
rsyslogd: run failed with error -2207 (see rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that number means)


I'm guessing I'm just being thick, but searching for 'rsyslog stop' doesn't get me the help I want :)
canadaboy
Avarage
 
Posts: 14
Joined: Fri Sep 30, 2011 8:36 pm

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: Problems with v7 and stop

Postby mbiebl » Sun Oct 21, 2012 10:24 pm

Hi,

if you want to replace "~" you should use the new syntax that was introduced in v6.
http://www.rsyslog.com/doc/v6compatibility.html
and
http://blog.gerhards.net/2011/07/rsyslo ... ments.html
have some more information.

Your particular example should now be written:

Code: Select all
auth,authpriv.* {
 /var/log/secure
 stop
}
mbiebl
Advanced
 
Posts: 42
Joined: Wed Dec 05, 2007 12:46 am

Re: Problems with v7 and stop

Postby rgerhards » Mon Oct 22, 2012 8:34 am

well, Michael is right on how to make things work, HOWEVER, I am currently thinking if the original problem described should be treated as a bug. I have to admit I did not fully think about action lists (the & operator) when I implemented the deprecated messages. Inside an action list, only actions are permitted (thus the name), however, it seems somewhat unnatural to explicitely prohibit action-like statements (like stop). Intuitiely, there is little to no difference between the two (and technically as well, e.g. the v7 optimizer actually replaces ~ by stop, even in an action list).

I tend to think that action lists should support action-like statements as well. However, I need to check if there are some hard facts inside the grammar that prevent this (getting a decent grammar that both supports old-style and new-style config is very challenging). Even if I can change that, the change will probably need to be rolled into v3 as it is somewhat major.

Thanks for the report and comments!
rgerhards
Site Admin
 
Posts: 3797
Joined: Thu Feb 13, 2003 11:57 am

Re: Problems with v7 and stop

Postby rgerhards » Mon Oct 22, 2012 9:26 am

I checked the situation. It looks like extending action-lists is fairly easy. HOWEVER, I am not bold enough to do this to 7.1, which will go into stable this week. So I disabled the warning there (see [1]), and re-enabled it in 7.3, together with the change to make this work.

Thanks again for alerting me, this was just at the right time :-)

Rainer
[1] http://git.adiscon.com/?p=rsyslog.git;a ... cf30ef12cc
rgerhards
Site Admin
 
Posts: 3797
Joined: Thu Feb 13, 2003 11:57 am

Re: Problems with v7 and stop

Postby canadaboy » Mon Oct 22, 2012 6:29 pm

mbiebl wrote:Hi,

if you want to replace "~" you should use the new syntax that was introduced in v6.
http://www.rsyslog.com/doc/v6compatibility.html
and
http://blog.gerhards.net/2011/07/rsyslo ... ments.html
have some more information.

Your particular example should now be written:

Code: Select all
auth,authpriv.* {
 /var/log/secure
 stop
}


Thanks - that got me away from the warnings, and helped me understand the syntax a little better. I'm working to convert my 5.x format to 6.x (7) format still.

Cheers
canadaboy
Avarage
 
Posts: 14
Joined: Fri Sep 30, 2011 8:36 pm

Re: Problems with v7 and stop

Postby canadaboy » Mon Oct 22, 2012 6:32 pm

rgerhards wrote:I checked the situation. It looks like extending action-lists is fairly easy. HOWEVER, I am not bold enough to do this to 7.1, which will go into stable this week. So I disabled the warning there (see [1]), and re-enabled it in 7.3, together with the change to make this work.

Thanks again for alerting me, this was just at the right time :-)

Rainer
[1] http://git.adiscon.com/?p=rsyslog.git;a ... cf30ef12cc


Thanks for the response ... I love providing feedback and actually seeing someone read and respond to it :)

I've converted over to the v6 syntax .. if the "& stop" starts working in another version i'll likely go back, as it's a little simpler to read, and is what my ops folks are used to.

Cheers!
canadaboy
Avarage
 
Posts: 14
Joined: Fri Sep 30, 2011 8:36 pm

Google Ads



Return to Configuration

Who is online

Users browsing this forum: No registered users and 2 guests

cron