mmnormalize doesn't load

General discussions here

Moderator: rgerhards

Google Ads


mmnormalize doesn't load

Postby ralleman » Thu Sep 21, 2017 10:28 am

I tried the below with v8.29 and 8.26, both give me this issue. How to resolve it?

According to this thread https://github.com/rsyslog/rsyslog/issues/1703, there is an issue with the packaging of rsyslog for centos (yum).

I'm getting:

8750.085944398:main thread : errmsg.c: Called LogMsg, msg: could not load module '/lib64/rsyslog/mmnormalize.so', dlopen: /lib64/rsyslog/mmnormalize.so: undefined symbol: ln_loadSamplesFromString
8750.090904918:main thread : errmsg.c: Called LogMsg, msg: module name 'mmnormalize' is unknown

Based on:

Code: Select all
module(load="imfile")
module(load="mmnormalize")
module(load="omelasticsearch")

main_queue(
  queue.workerThreads="4"
  queue.dequeueBatchSize="1000"
  queue.size="10000"
)

input(type="imfile"
  file="/var/log/..../....."
  tag="....:"
  addMetadata="on"
  readMode="2"
  ruleset="...."
)

ruleset(name="....") {
  action(type="mmnormalize" rule=["rule=:%date:word% %time:word% [%thread:char-to:]%] [%rid:char-to:]%] [%uid:char-to:]%] %level:word% %logger:word% - "])
  action(type="omelasticsearch"
    template="...."
    searchIndex="....."
    server="logsene-receiver.sematext.com"
    serverport="443"
    bulkmode="on"
    queue.dequeuebatchsize="100"
    action.resumeretrycount="-1"
  )
}

...
ralleman
New
 
Posts: 3
Joined: Thu Sep 21, 2017 10:00 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: mmnormalize doesn't load

Postby ralleman » Thu Sep 21, 2017 11:01 am

Looks like the package references the wrong version of liblognorm, which according to the release notes should be 2.0.3.

================================================================================================================================================
Package Arch Version Repository Size
================================================================================================================================================
Installing:
rsyslog x86_64 8.29.0-1.el7 rsyslog-v8-stable 652 k
rsyslog-elasticsearch x86_64 8.29.0-1.el7 rsyslog-v8-stable 22 k
rsyslog-mmnormalize x86_64 8.29.0-1.el7 rsyslog-v8-stable 16 k
Installing for dependencies:
liblognorm x86_64 2.0.2-1.el7 base 75 k
ralleman
New
 
Posts: 3
Joined: Thu Sep 21, 2017 10:00 am

Re: mmnormalize doesn't load

Postby friedl » Thu Sep 21, 2017 5:05 pm

I did some research on this and realized that there is a liblognorm RPM in the base repo with version 2.0.2. This conflicts with our own RPM (liblognorm5), because differently named RPMs cannot overwrite similar/same .so files.

The problem you have is, because liblognorm obviously gets installed from the base repo with priority (or so I assume). Version 2.0.2 is missing some features over 2.0.3 which are a hard requirement for rsyslog 8.29.0.

Just now, I have rebuilt the RPM for rsyslog with changed requirements in the dependency sections for liblognorm. In my test this assured that the correct version of liblognorm (2.0.3) was installed with the mmnormalize RPM from our repository instead of the base repo. The RPM is available already and you should be able to install it.

If something in my description above is not correct and somebody reading this knows better, please comment and correct.
friedl
Adiscon Support
 
Posts: 67
Joined: Wed Sep 13, 2006 2:31 pm

Re: mmnormalize doesn't load

Postby ralleman » Thu Sep 21, 2017 11:48 pm

Thanks. This worked with the caveat that I had to remove liblognorm because the liblognorm5 library was conflicting with it. Hopefully that doesn't cause an issue.
ralleman
New
 
Posts: 3
Joined: Thu Sep 21, 2017 10:00 am

Google Ads



Return to General

Who is online

Users browsing this forum: No registered users and 0 guests

cron