Rsyslog imfile error: no file name given

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: rgerhards

Google Ads


Rsyslog imfile error: no file name given

Postby shivkumar » Wed Dec 20, 2017 1:13 pm

I am using rsyslog version 8.24.0 on Centos




Code: Select all
module(load="imfile") #needs to be done just once
# File 1
input(type="imfile"
  mode="inotify"
  File="/var/log/application/*hello.log"
  Tag="application-access-logs"
  Severity="info"
  PersistStateInterval="20000"
)

$PrivDropToGroup adm
$WorkDirectory /var/spool/rsyslog
$InputRunFileMonitor

#Template for application access events
$template ApplicationLogs,"%HOSTNAME% %msg%\n"


if $programname == 'application-access-logs' then @@xx.xx.xx.xx:12345;ApplicationLogs
if $programname == 'application-access-logs' then ~


Dec 20 10:53:38 ip-1-2-3-4 systemd: Starting System Logging Service...
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0" x-pid="12233" ] start
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: $WorkDirectory: /var/spool/rsyslog can not be accessed, probably does not exist - directive ignored [v8.24.0 try http://www.rsyslog.com/e/2181 ]
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: imfile error: no file name given, file monitor can not be created [v8.24.0 try http://www.rsyslog.com/e/2046 ]
Dec 20 10:53:38 ip-1-2-3-4 systemd: Started System Logging Service.
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: imfile: The to-be-monitored file "/var/log/application/*hello.log" contains wildcards. This is not supported in polling mode. [v8.24.0 try http://www.rsyslog.com/e/2420 ]
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: imfile: no file monitors could be started, input not activated. [v8.24.0]
Dec 20 10:53:38 ip-1-2-3-4 rsyslogd: activation of module imfile failed [v8.24.0 try http://www.rsyslog.com/e/-3 ]
shivkumar
New
 
Posts: 6
Joined: Wed Dec 20, 2017 12:18 pm

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: Rsyslog imfile error: no file name given

Postby rgerhards » Wed Dec 20, 2017 2:12 pm

$InputRunFileMonitor is old-style for defining an input(). So you are trying to define a second imfile input(), but did not specify a file name. I guess you can simply delete $InputRunFileMonitor in your case... If you need more than one file monitor, continue with input().
rgerhards
Site Admin
 
Posts: 3806
Joined: Thu Feb 13, 2003 11:57 am

Re: Rsyslog imfile error: no file name given

Postby deoren » Wed Dec 20, 2017 6:25 pm

Rainer already covered the specific problem you reported, but looking at the error messages I see you are trying to use /var/spool/rsyslog as your WorkDirectory value.

I was bit by doing just that recently, so I suggest double checking to make sure that the /var/spool/rsyslog directory actually exists. value is correct. That appears to be a value used for Ubuntu/Debian systems; on CentOS 6 and 7 I believe that /var/lib/rsyslog is instead the correct value.
deoren
New
 
Posts: 3
Joined: Wed Dec 13, 2017 6:49 am

Re: Rsyslog imfile error: no file name given

Postby shivkumar » Thu Jan 04, 2018 12:09 pm

Jan 04 11:06:43 ip-10-0-3-240.ec2.internal systemd[1]: Starting System Logging Service...
Jan 04 11:06:43 ip-10-0-3-240.ec2.internal rsyslogd[8770]: [origin software="rsyslogd" swVersion="8.24.0" x-pid="8770" x-info="http://www.rsyslog.com"] start
Jan 04 11:06:43 ip-10-0-3-240.ec2.internal rsyslogd[8770]: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.24.0 try http://ww...e/2307 ]
Jan 04 11:06:43 ip-10-0-3-240.ec2.internal rsyslogd[8770]: imfile: The to-be-monitored file "/var/log/application/*hello.log" contains wildcards. This is not support...e/2420 ]
Jan 04 11:06:43 ip-10-0-3-240.ec2.internal rsyslogd[8770]: imfile: no file monitors could be started, input not activated. [v8.24.0]
Jan 04 11:06:43 ip-10-0-3-240.ec2.internal rsyslogd[8770]: activation of module imfile failed [v8.24.0 try http://www.rsyslog.com/e/-3 ]

Jan 04 11:06:43 ip-10-0-3-240.ec2.internal systemd[1]: Started System Logging Service.
Hint: Some lines were ellipsized, use -l to show in full.

I am still facing the above issue and my logs are not being pushed to my tcp endpoint.
shivkumar
New
 
Posts: 6
Joined: Wed Dec 20, 2017 12:18 pm

Re: Rsyslog imfile error: no file name given

Postby rgerhards » Thu Jan 04, 2018 12:26 pm

config?
rgerhards
Site Admin
 
Posts: 3806
Joined: Thu Feb 13, 2003 11:57 am

Re: Rsyslog imfile error: no file name given

Postby shivkumar » Thu Jan 04, 2018 1:26 pm

Code: Select all
global(workDirectory="/var/lib/rsyslog")
module(load="imfile") #needs to be done just once
# File 1
input(type="imfile"
  mode="inotify"
  File="/var/log/application/*hello.log"
  Tag="application-access-logs"
  Severity="info"
  PersistStateInterval="20000"
)

$PrivDropToGroup root

#Template for application access events
$template ApplicationLogs,"%HOSTNAME% %msg%\n"


if $programname == 'application-access-logs' then @@xx.xx.xx.xx:12345;ApplicationLogs
if $programname == 'application-access-logs' then ~
shivkumar
New
 
Posts: 6
Joined: Wed Dec 20, 2017 12:18 pm

Re: Rsyslog imfile error: no file name given

Postby rgerhards » Thu Jan 04, 2018 2:18 pm

ah, I didn't notice at first. The version is too old. Initial wildcard support was in 8.25.0. Note that I would still recommend a current version (8.31) as there were several fixes to imfile in the past year since that feature was released.
rgerhards
Site Admin
 
Posts: 3806
Joined: Thu Feb 13, 2003 11:57 am

Re: Rsyslog imfile error: no file name given

Postby shivkumar » Thu Jan 04, 2018 2:42 pm

I have tried by removing the wildcard as follows :

file="/var/log/application/hello.log"

But then I get the following message when I do
Code: Select all
sudo service rsyslog status


Code: Select all
action 'action 1' suspended, next retry is Thu Jan  4 13:22:15 2018 [v8.24.0 try http://www.rsyslog...e/2007 ]


The log events are still not pushed to my tcp endpoint , even I work with single file.
shivkumar
New
 
Posts: 6
Joined: Wed Dec 20, 2017 12:18 pm

Re: Rsyslog imfile error: no file name given

Postby shivkumar » Thu Jan 04, 2018 2:57 pm

I have updated to 8.31

This is the output of
Code: Select all
rsyslogd -version

Code: Select all
rsyslogd 8.31.0, compiled with:
   PLATFORM:            x86_64-redhat-linux-gnu
   PLATFORM (lsb_release -d):      
   FEATURE_REGEXP:            Yes
   GSSAPI Kerberos 5 support:      No
   FEATURE_DEBUG (debug build, slow code):   No
   32bit Atomic operations supported:   Yes
   64bit Atomic operations supported:   Yes
   memory allocator:         system default
   Runtime Instrumentation (slow code):   No
   uuid support:            Yes
   Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.


And now I am trying with wildcard , it is not showing any error but the events are not pushed to my tcp endpoint.
Here is the output of
Code: Select all
sudo service rsyslog status


Code: Select all
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2018-01-04 13:51:14 UTC; 1min 13s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 1740 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           └─1740 /sbin/rsyslogd -n

Jan 04 13:51:14 ip-10-0-3-240.ec2.internal systemd[1]: Starting System Logging Service...
Jan 04 13:51:14 ip-10-0-3-240.ec2.internal systemd[1]: Started System Logging Service.



Following is my new configuration :


Code: Select all
global(workDirectory="/var/lib/rsyslog")
module(load="imfile") #needs to be done just once
# File 1
input(type="imfile"
  mode="inotify"
  File="/var/log/application/*hello.log"
  Tag="application-access-logs"
  Severity="info"
  PersistStateInterval="20000"
)

#Template for application access events
$template ApplicationLogs,"%HOSTNAME% %msg%\n"


if $programname == 'application-access-logs' then @@xx.xx.xx.xx:12345;ApplicationLogs
if $programname == 'application-access-logs' then ~
shivkumar
New
 
Posts: 6
Joined: Wed Dec 20, 2017 12:18 pm

Re: Rsyslog imfile error: no file name given

Postby shivkumar » Fri Jan 05, 2018 6:49 am

I tried again by removing wild card and to monitor a single file and send the events to my tcp endpoint.

Here is my configuration :

Code: Select all
global(workDirectory="/var/lib/rsyslog")
module(load="imfile") #needs to be done just once

# File 1
input(type="imfile"

  file="/var/log/application/hello.log"
  Tag="application-access-logs"
  Severity="info"
  PersistStateInterval="20000"
)

$PrivDropToUser root

#Template for application access events
$template ApplicationLogs,"%HOSTNAME% %msg%\n"


if $programname == 'application-access-logs' then @@xx.xx.xx.xx:12345;ApplicationLogs
if $programname == 'application-access-logs' then stop



Please pay attention :

I have not specified any mode

I have dropped privileges to user root

I have used stop keyword now

I have changed file ( hello.log ) permission to 777




Stil the events are not pushed to my endpoint
shivkumar
New
 
Posts: 6
Joined: Wed Dec 20, 2017 12:18 pm

Google Ads



Return to Configuration

Who is online

Users browsing this forum: No registered users and 1 guest

cron