MonitorWare Knowledge Base

[tomeq]

Hi!

I'm new user of rsyslog. I tried to find solution in doc but no success. The problem is simple: I can't get -- MARK -- appearing in my logfiles. My config is pretty obvious and simple:

/etc/rsyslog.conf:

Code: Select all


$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark  # provides --MARK-- message capability
$MarkMessagePeriod 1800

$KLogPath /var/run/rsyslog/kmsg

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


and "core" part of my logging, oldschool way. /etc/rsyslog.d/50-default.conf:

Code: Select all


auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

# local logs
local0.*                        /var/log/LOGS/local0.log
local1.*                        /var/log/LOGS/local1.log
local2.*                        /var/log/LOGS/local2.log
local3.*                        /var/log/LOGS/local3.log
local4.*                        /var/log/LOGS/local4.log
local5.*                        /var/log/LOGS/local5.log
local6.*                        /var/log/LOGS/local6.log
local7.*                        /var/log/LOGS/local7.log



No marks appearing anywhere. Do I need to configure something more to get logfiles marked? Am I missing something crucial?

Greets,
Tomek

[rgerhards]

did you make sure that no messages appear during the mark message period? Remember that marks are only wirtten if there is no activity.

[tomeq]

did you make sure that no messages appear during the mark message period? Remember that marks are only wirtten if there is no activity.

Yep, I'm pretty sure that nothing was written.
for example, excerpt from local7

Code: Select all

Feb 7 03:24:52 host_A 17720: Feb 7 03:24:51.110: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial4/0/0:10, changed state to up
Feb 7 03:25:05 host_A 17721: Feb 7 03:25:04.822: %OSPF-5-ADJCHG: Process 1, Nbr xxxxx on Serial4/0/0:10 from LOADING to FULL, Loading Done
Feb 8 08:21:46 host_B 3944: Feb 8 08:21:45.303: %HA_EM-6-LOG: SLA_5_Timeout: Ping to xxxx timeout
Feb 8 08:21:46 host_B 3945:


and no marks between 03:25 and 08:21

[tomeq]

forgot to include the version: rsyslog 4.2.0-2ubuntu5.1
Ubuntu 9.10 Server, x86

[tomeq]

Doing further investigation - I see marks only in kern.log and no other file. This is not what I expected from mark functionality