CentOS 7: rsyslog can't run propertly external script

Everything related with getting rsyslog up and running (but not beyond that point ;))

Moderator: rgerhards

Google Ads


CentOS 7: rsyslog can't run propertly external script

Postby Genluck » Fri Jul 01, 2016 9:37 am

Hello everyone.
I have a strange problem with rsyslog in CentOS 7. I did install it via yum. My problem is that my scrip that is running by rsyslog is working in strange way. The scrip itself is:
Code: Select all
# Run child process
sudo -u rancid /usr/local/etc/rancid/bin/rancid-run -r $1
# Bellow is testing part
echo "$1" >> /var/log/variables

When rsyslog has been running via systemctl the test part worked well but my child proccess hasn't been execucet. But if I run rsyslog mannually from a root user (command "/usr/sbin/rsyslogd -n") both parts at my script works well. Why could this happens? BTW if I'm running rsyslog under root user just by typing "/usr/sbin/rsyslogd" my script works strange too.

For information:
OS is CentOS Linux release 7.2.1511 (Core)
Configuration of rsyslog.conf:
Code: Select all
$ModLoad imuxsock
$ModLoad imjournal
$ModLoad imudp
$UDPServerRun 514
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state

# Run config backup after change of configuration at the Cisco devices
$template HostIP,"%FROMHOST-IP%"
:msg, contains, "%SYS-5-CONFIG_I: Configured from console by test on console" ^/home/run-script.sh;HostIP

Best Regards.
Genluck
New
 
Posts: 4
Joined: Fri Jul 01, 2016 9:15 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: CentOS 7: rsyslog can't run propertly external script

Postby dlang » Fri Jul 01, 2016 5:26 pm

It's probably a problem with the SELinux config/tags

when you run things as root they have different (and wider) SELinux permissions than if you run them from systemctl/init
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: CentOS 7: rsyslog can't run propertly external script

Postby Genluck » Mon Jul 04, 2016 7:35 am

Hi, dlang.

Thanks for your answer and you help.

I disabled selinux after OS instlation. Right now:
Code: Select all
# sestatus
SELinux status:                 disabled


Best Regards.
Genluck
New
 
Posts: 4
Joined: Fri Jul 01, 2016 9:15 am

Re: CentOS 7: rsyslog can't run propertly external script

Postby dlang » Wed Jul 06, 2016 8:04 pm

I would suggest that you use omprog It is much more reliable than ^ and when using the new config is much clearer about what's happening.
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: CentOS 7: rsyslog can't run propertly external script

Postby Genluck » Thu Jul 07, 2016 8:44 am

Hi, dlang.

Thanks for your help. What is better way to send IP address as argument? Will this be ok?

Code: Select all
$template HostIP,"%FROMHOST-IP%"
$ActionOMProgBinary /home/run-script.sh
:msg, contains, "%SYS-5-CONFIG_I: Configured from console by test on console" :omprog:;HostIP


Best Regards.
Genluck
New
 
Posts: 4
Joined: Fri Jul 01, 2016 9:15 am

Re: CentOS 7: rsyslog can't run propertly external script

Postby dlang » Thu Jul 07, 2016 7:21 pm

since you are using rsyslog 7+, you can use the action() format

http://www.rsyslog.com/doc/v8-stable/co ... mprog.html

module(load="omprog")
action(type="omprog"
binary="/pathto/omprog.py --parm1=\"value 1\" --parm2=\"value2\"
template="RSYSLOG_TraditionalFileFormat")
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: CentOS 7: rsyslog can't run propertly external script

Postby Genluck » Fri Jul 08, 2016 7:54 am

Hi, dlang.

Thank you very much for an information. I saw this documentation but it's not clear for me. Can I use syslog variables (like %fromhost-ip% or %$day%) in binary section? And how it will use template (will it add it as argument at the end of command line)?

Best Regards.
Genluck
New
 
Posts: 4
Joined: Fri Jul 01, 2016 9:15 am

Re: CentOS 7: rsyslog can't run propertly external script

Postby dlang » Fri Jul 08, 2016 8:13 am

look at the page on properties
http://www.rsyslog.com/doc/v8-stable/co ... rties.html


the property replacer talks about how properties are used in templates
http://www.rsyslog.com/doc/v8-stable/co ... lacer.html

There is this page about the different types of properties that are available on current versions
http://www.rsyslog.com/doc/v8-stable/ra ... types.html

loon in the section on rainerscript

http://www.rsyslog.com/doc/v8-stable/ra ... index.html
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Google Ads



Return to Installation

Who is online

Users browsing this forum: No registered users and 2 guests

cron