v8.27.0 - Imfile - Path with wildcard in directories path don't work

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

v8.27.0 - Imfile - Path with wildcard in directories path don't work

Jerome CARDON
Hi all,

I'm try to use imfile module with a path containing wildcard in directories. When rsyslog start, I've got this message in rsyslog.log :

Jul 13 18:00:58 ALT190-P rsyslogd: rsyslogd's groupid changed to 108
Jul 13 18:00:58 ALT190-P rsyslogd: rsyslogd's userid changed to 104
Jul 13 18:00:58 ALT190-P rsyslogd:  [origin software="rsyslogd" swVersion="8.27.0" x-pid="25840" x-info="http://www.rsyslog.com"<http://www.rsyslog.com>] start
Jul 13 18:00:58 ALT190-P rsyslogd: imfile: error with inotify API, ignoring file '/data/www/xxxx/*/shared/var/log/exception.log': No such file or directory  [v8.27.0]


As you can see, I'm using rsyslog v8.27.0 on ubuntu from PPA adiscon (last available at this time).

root@ALT190-P:~# rsyslogd -v
rsyslogd 8.27.0, compiled with:
    PLATFORM:                x86_64-pc-linux-gnu
    PLATFORM (lsb_release -d):
    FEATURE_REGEXP:                Yes
    GSSAPI Kerberos 5 support:        No
    FEATURE_DEBUG (debug build, slow code):    No
    32bit Atomic operations supported:    Yes
    64bit Atomic operations supported:    Yes
    memory allocator:            system default
    Runtime Instrumentation (slow code):    No
    uuid support:                Yes
    Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.


Part of my config, this work just fine :
input(type="imfile" File="/data/www/xxxx/applogs/*.*.log"
       Tag="exception:" Severity="info" Facility="local7" freshStartTail="on" reopenOnTruncate="on"
       startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
       readTimeout="3" addMetadata="on" ruleset="sisley_logs_type_parser")

input(type="imfile" File="/data/www/xxxx/logs/sisley*.xxxx-preprod.com.access.log"
       Tag="http.access:" Severity="info" Facility="local7" freshStartTail="on"
       addMetadata="on" ruleset="sisley_logs_instance_parser")

This dont' work :
input(type="imfile" File="/data/www/xxxx/*/shared/var/log/exception.log"
       Tag="exception:" Severity="info" Facility="local7" freshStartTail="on" reopenOnTruncate="on"
       startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
       readTimeout="3" addMetadata="on" ruleset="sisley_logs_instance_parser")

I have just one level under "*" between "/data/www/xxx" and "shared/var...".

Have I missing something in config file to enable this feature ?
Some help will be appreciate

Thanks a lot

Jerome



_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: v8.27.0 - Imfile - Path with wildcard in directories path don't work

Andre Lorbach-2
Hi Jermone,

there seems to be no matching file on startup.
However the directory watch should be created before regardless of this
error.
Does imfile detect files in your configured directory?

Best regards,
Andre

> -----Original Message-----
> From: rsyslog [mailto:[hidden email]] On Behalf Of
> Jerome CARDON
> Sent: Thursday, July 13, 2017 6:28 PM
> To: [hidden email]
> Subject: [rsyslog] v8.27.0 - Imfile - Path with wildcard in directories
path don't
> work
>
> Hi all,
>
> I'm try to use imfile module with a path containing wildcard in
directories.
> When rsyslog start, I've got this message in rsyslog.log :
>
> Jul 13 18:00:58 ALT190-P rsyslogd: rsyslogd's groupid changed to 108 Jul
13
> 18:00:58 ALT190-P rsyslogd: rsyslogd's userid changed to 104 Jul 13
18:00:58
> ALT190-P rsyslogd:  [origin software="rsyslogd" swVersion="8.27.0" x-
> pid="25840" x-info="http://www.rsyslog.com"<http://www.rsyslog.com>]
> start Jul 13 18:00:58 ALT190-P rsyslogd: imfile: error with inotify API,
ignoring
> file '/data/www/xxxx/*/shared/var/log/exception.log': No such file or
> directory  [v8.27.0]
>
>
> As you can see, I'm using rsyslog v8.27.0 on ubuntu from PPA adiscon
(last

> available at this time).
>
> root@ALT190-P:~# rsyslogd -v
> rsyslogd 8.27.0, compiled with:
>     PLATFORM:                x86_64-pc-linux-gnu
>     PLATFORM (lsb_release -d):
>     FEATURE_REGEXP:                Yes
>     GSSAPI Kerberos 5 support:        No
>     FEATURE_DEBUG (debug build, slow code):    No
>     32bit Atomic operations supported:    Yes
>     64bit Atomic operations supported:    Yes
>     memory allocator:            system default
>     Runtime Instrumentation (slow code):    No
>     uuid support:                Yes
>     Number of Bits in RainerScript integers: 64
>
> See http://www.rsyslog.com for more information.
>
>
> Part of my config, this work just fine :
> input(type="imfile" File="/data/www/xxxx/applogs/*.*.log"
>        Tag="exception:" Severity="info" Facility="local7"
freshStartTail="on"
> reopenOnTruncate="on"
>        startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-
> [[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
>        readTimeout="3" addMetadata="on"
ruleset="sisley_logs_type_parser")
>
> input(type="imfile" File="/data/www/xxxx/logs/sisley*.xxxx-
> preprod.com.access.log"
>        Tag="http.access:" Severity="info" Facility="local7"
freshStartTail="on"
>        addMetadata="on" ruleset="sisley_logs_instance_parser")
>
> This dont' work :
> input(type="imfile" File="/data/www/xxxx/*/shared/var/log/exception.log"
>        Tag="exception:" Severity="info" Facility="local7"
freshStartTail="on"

> reopenOnTruncate="on"
>        startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-
> [[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
>        readTimeout="3" addMetadata="on"
> ruleset="sisley_logs_instance_parser")
>
> I have just one level under "*" between "/data/www/xxx" and
> "shared/var...".
>
> Have I missing something in config file to enable this feature ?
> Some help will be appreciate
>
> Thanks a lot
>
> Jerome
>
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond
> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: v8.27.0 - Imfile - Path with wildcard in directories path don't work

Rainer Gerhards
Andre,

in spite of what you said, I would appreciate if we could change the
code so that the error message actually indicates what you just said.
We only need to be sure that for non-wildcard cases the message is
different (and up to the point).

Would you be avalable to do this (if so, I'd appreciate if you could
also add a github issue tracker).

Thanks,
Rainer

2017-07-14 9:00 GMT+02:00 Andre Lorbach <[hidden email]>:

> Hi Jermone,
>
> there seems to be no matching file on startup.
> However the directory watch should be created before regardless of this
> error.
> Does imfile detect files in your configured directory?
>
> Best regards,
> Andre
>
>> -----Original Message-----
>> From: rsyslog [mailto:[hidden email]] On Behalf Of
>> Jerome CARDON
>> Sent: Thursday, July 13, 2017 6:28 PM
>> To: [hidden email]
>> Subject: [rsyslog] v8.27.0 - Imfile - Path with wildcard in directories
> path don't
>> work
>>
>> Hi all,
>>
>> I'm try to use imfile module with a path containing wildcard in
> directories.
>> When rsyslog start, I've got this message in rsyslog.log :
>>
>> Jul 13 18:00:58 ALT190-P rsyslogd: rsyslogd's groupid changed to 108 Jul
> 13
>> 18:00:58 ALT190-P rsyslogd: rsyslogd's userid changed to 104 Jul 13
> 18:00:58
>> ALT190-P rsyslogd:  [origin software="rsyslogd" swVersion="8.27.0" x-
>> pid="25840" x-info="http://www.rsyslog.com"<http://www.rsyslog.com>]
>> start Jul 13 18:00:58 ALT190-P rsyslogd: imfile: error with inotify API,
> ignoring
>> file '/data/www/xxxx/*/shared/var/log/exception.log': No such file or
>> directory  [v8.27.0]
>>
>>
>> As you can see, I'm using rsyslog v8.27.0 on ubuntu from PPA adiscon
> (last
>> available at this time).
>>
>> root@ALT190-P:~# rsyslogd -v
>> rsyslogd 8.27.0, compiled with:
>>     PLATFORM:                x86_64-pc-linux-gnu
>>     PLATFORM (lsb_release -d):
>>     FEATURE_REGEXP:                Yes
>>     GSSAPI Kerberos 5 support:        No
>>     FEATURE_DEBUG (debug build, slow code):    No
>>     32bit Atomic operations supported:    Yes
>>     64bit Atomic operations supported:    Yes
>>     memory allocator:            system default
>>     Runtime Instrumentation (slow code):    No
>>     uuid support:                Yes
>>     Number of Bits in RainerScript integers: 64
>>
>> See http://www.rsyslog.com for more information.
>>
>>
>> Part of my config, this work just fine :
>> input(type="imfile" File="/data/www/xxxx/applogs/*.*.log"
>>        Tag="exception:" Severity="info" Facility="local7"
> freshStartTail="on"
>> reopenOnTruncate="on"
>>        startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-
>> [[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
>>        readTimeout="3" addMetadata="on"
> ruleset="sisley_logs_type_parser")
>>
>> input(type="imfile" File="/data/www/xxxx/logs/sisley*.xxxx-
>> preprod.com.access.log"
>>        Tag="http.access:" Severity="info" Facility="local7"
> freshStartTail="on"
>>        addMetadata="on" ruleset="sisley_logs_instance_parser")
>>
>> This dont' work :
>> input(type="imfile" File="/data/www/xxxx/*/shared/var/log/exception.log"
>>        Tag="exception:" Severity="info" Facility="local7"
> freshStartTail="on"
>> reopenOnTruncate="on"
>>        startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-
>> [[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
>>        readTimeout="3" addMetadata="on"
>> ruleset="sisley_logs_instance_parser")
>>
>> I have just one level under "*" between "/data/www/xxx" and
>> "shared/var...".
>>
>> Have I missing something in config file to enable this feature ?
>> Some help will be appreciate
>>
>> Thanks a lot
>>
>> Jerome
>>
>>
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
>> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
> beyond
>> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: v8.27.0 - Imfile - Path with wildcard in directories path don't work

Jerome CARDON
In reply to this post by Andre Lorbach-2
Hello Andre,

Thanks for your reply. I checked this point too. All files and directory
were created before and the error message still appears in syslog.log.
Imfile does detect any changes in configured path.
Imfile module is loaded in inotity mode.
I checked ACL on files and path, everything seems good, directories have
755 permissions and files 664.

I've tested with and without wilcard on the same path.
File="/data/www/xxx/*/shared/var/log/exception.log" don't work and error
message appear in syslog.log.
File="/data/www/xxx/yyy/shared/var/log/exception.log" work fine.

Any clue ?
Thanks in advance
Jerome

On 14/07/2017 09:00, Andre Lorbach wrote:

> Hi Jermone,
>
> there seems to be no matching file on startup.
> However the directory watch should be created before regardless of this
> error.
> Does imfile detect files in your configured directory?
>
> Best regards,
> Andre
>
>> -----Original Message-----
>> From: rsyslog [mailto:[hidden email]] On Behalf Of
>> Jerome CARDON
>> Sent: Thursday, July 13, 2017 6:28 PM
>> To: [hidden email]
>> Subject: [rsyslog] v8.27.0 - Imfile - Path with wildcard in directories
> path don't
>> work
>>
>> Hi all,
>>
>> I'm try to use imfile module with a path containing wildcard in
> directories.
>> When rsyslog start, I've got this message in rsyslog.log :
>>
>> Jul 13 18:00:58 ALT190-P rsyslogd: rsyslogd's groupid changed to 108 Jul
> 13
>> 18:00:58 ALT190-P rsyslogd: rsyslogd's userid changed to 104 Jul 13
> 18:00:58
>> ALT190-P rsyslogd:  [origin software="rsyslogd" swVersion="8.27.0" x-
>> pid="25840" x-info="https://antiphishing.altima.fr/proxy/1/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/www.rsyslog.com"<http://www.rsyslog.com>]
>> start Jul 13 18:00:58 ALT190-P rsyslogd: imfile: error with inotify API,
> ignoring
>> file '/data/www/xxxx/*/shared/var/log/exception.log': No such file or
>> directory  [v8.27.0]
>>
>>
>> As you can see, I'm using rsyslog v8.27.0 on ubuntu from PPA adiscon
> (last
>> available at this time).
>>
>> root@ALT190-P:~# rsyslogd -v
>> rsyslogd 8.27.0, compiled with:
>>      PLATFORM:                x86_64-pc-linux-gnu
>>      PLATFORM (lsb_release -d):
>>      FEATURE_REGEXP:                Yes
>>      GSSAPI Kerberos 5 support:        No
>>      FEATURE_DEBUG (debug build, slow code):    No
>>      32bit Atomic operations supported:    Yes
>>      64bit Atomic operations supported:    Yes
>>      memory allocator:            system default
>>      Runtime Instrumentation (slow code):    No
>>      uuid support:                Yes
>>      Number of Bits in RainerScript integers: 64
>>
>> See https://antiphishing.altima.fr/proxy/1/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/www.rsyslog.com for more information.
>>
>>
>> Part of my config, this work just fine :
>> input(type="imfile" File="/data/www/xxxx/applogs/*.*.log"
>>         Tag="exception:" Severity="info" Facility="local7"
> freshStartTail="on"
>> reopenOnTruncate="on"
>>         startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-
>> [[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
>>         readTimeout="3" addMetadata="on"
> ruleset="sisley_logs_type_parser")
>> input(type="imfile" File="/data/www/xxxx/logs/sisley*.xxxx-
>> preprod.com.access.log"
>>         Tag="http.access:" Severity="info" Facility="local7"
> freshStartTail="on"
>>         addMetadata="on" ruleset="sisley_logs_instance_parser")
>>
>> This dont' work :
>> input(type="imfile" File="/data/www/xxxx/*/shared/var/log/exception.log"
>>         Tag="exception:" Severity="info" Facility="local7"
> freshStartTail="on"
>> reopenOnTruncate="on"
>>         startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-
>> [[:digit:]]{2}T[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"
>>         readTimeout="3" addMetadata="on"
>> ruleset="sisley_logs_instance_parser")
>>
>> I have just one level under "*" between "/data/www/xxx" and
>> "shared/var...".
>>
>> Have I missing something in config file to enable this feature ?
>> Some help will be appreciate
>>
>> Thanks a lot
>>
>> Jerome
>>
>>
>>
>> _______________________________________________
>> rsyslog mailing list
>> https://antiphishing.altima.fr/proxy/1/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/lists.adiscon.net/mailman/listinfo/rsyslog
>> https://antiphishing.altima.fr/proxy/1/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://antiphishing.altima.fr/proxy/2/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/twitter.com/rgerhards NOTE WELL:
>> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
> beyond
>> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://antiphishing.altima.fr/proxy/1/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/lists.adiscon.net/mailman/listinfo/rsyslog
> https://antiphishing.altima.fr/proxy/1/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://antiphishing.altima.fr/proxy/2/amNhcmRvbkBhbHRpbWEtYWdlbmN5LmNvbQ%3D%3D/twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Loading...