Errors with default config for Centos 5.11

[ksemaev]

Loading with default settings class { 'rsyslog::client': } gives errors on Centos 5.11 (rsyslog 3.22.1):

Dec 17 17:27:43 cnt3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.1" x-pid="2578" x-info="http://www.rsyslog.com"] (re)start
Dec 17 17:27:43 cnt3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.1" x-pid="2578" x-info="http://www.rsyslog.com"] (re)start
Dec 17 17:27:43 cnt3 rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
Dec 17 17:27:43 cnt3 rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
Dec 17 17:27:43 cnt3 rsyslogd: the last error occured in /etc/rsyslog.conf, line 21
Dec 17 17:27:43 cnt3 rsyslogd: the last error occured in /etc/rsyslog.conf, line 21

Which basicly reports for those settings:

$SystemLogRateLimitInterval 1
$SystemLogRateLimitBurst 100
$PrivDropToUser root
$PrivDropToGroup root

[saz]

Can you check, if this error still exists with the newest release?

[ksemaev]

You mean the newest release of module? I am using the last one: 5.0.0 from Nov 18th 2016 and the problem remains.

[saz]

Your rsyslog version is 3.22.1?

[ksemaev]

Yep. it's the last avaliable for centos 5.11 (https://www.rpmfind.net/linux/rpm2html/search.php?query=rsyslog&submit=Search+...&system=Centos&arch=)

[saz]

It looks like, as if this version is lacking support for rate limiting on imuxsock.

Can you set rsyslog::client::rate_limit_burst and rsyslog::client::rate_limit_interval to undef and check if it's working for you?

[ksemaev]

Tried changing to undef in https://github.com/saz/puppet-rsyslog/blob/master/manifests/params.pp so now I only have them in my rsyslog.conf without values:

#
# Set rate limit for messages received.
#
$SystemLogRateLimitInterval
$SystemLogRateLimitBurst

[saz]

You're right. Can you show me the params you're passing in?

[ksemaev]

Surely, I have them in hiera, so:

classes:
   - rsyslog::client

rsyslog::client::log_remote: false
rsyslog::client::log_local: true
rsyslog::client::spool_size: '10m'

[saz]

Can you change the following lines in templates/client/config.conf.erb from

<% if scope.lookupvar('rsyslog::client::rate_limit_burst') and scope.lookupvar('rsyslog::client::rate_limit_burst') != :undef -%>
$SystemLogRateLimitBurst <%= scope.lookupvar('rsyslog::client::rate_limit_burst') %>
<% end -%>
<% if scope.lookupvar('rsyslog::client::rate_limit_interval') and scope.lookupvar('rsyslog::client::rate_limit_interval') != :undef -%>
$SystemLogRateLimitInterval <%= scope.lookupvar('rsyslog::client::rate_limit_interval') %>
<% end -%>

to

<% if @rate_limit_burst -%>
$SystemLogRateLimitBurst <%= @rate_limit_burst %>
<% end -%>
<% if @rate_limit_interval -%>
$SystemLogRateLimitInterval <%= @rate_limit_interval %>
<% end -%>

and check the generated rsyslog config again?

[ksemaev]

Tried, but no luck, these two parametrs stayed with no value (even removed /etc/rsyslog.conf for better luck before syncing).

#
# Set rate limit for messages received.
#
$SystemLogRateLimitInterval
$SystemLogRateLimitBurst

[saz]

I've found the issue. Those settings were duplicated in rsyslog and rsyslog::client. rsyslog::client::rate_limit_interval and rsyslog::client::rate_limit_burst are now removed from rsyslog::client in favor of rsyslog::system_log_rate_limit_interval and rsyslog::system_log_rate_limit_burst.

In your case, you have to change those two params to either false or undef. Please give the current master a try.

[ksemaev]

Sorry for so much trouble, but after updating module (removing those "rate_limit_interval" lines from client.pp) and setting values ("system_log_rate_limit") in params.pp left me with this :

1. setting rsyslog::system_log_rate_limit_interval to undef leaves this string in config:

# Set rate limit for messages received.
#
$SystemLogRateLimitInterval

or 2) setting rsyslog::system_log_rate_limit_interval to false leaves this string in config:

# Set rate limit for messages received.
#
$SystemLogRateLimitInterval false

So the string "$SystemLogRateLimitInterval" stays in config file. I tried to remove it from params.pp absolutely, but no change: it is still in config file. Is there any way to get rid of it?)))

[ubellavance]

Have you tried the master? I think that there is more to it than your manual edits and I think that the master should fix it. If you insist on manual edits for now, you must make sure you implement all the changes in commit 9db3f5b.

[sirinek]

In reference to your original error... PrivDropToUser and PrivDropToGroup are not available in rsyslogd until 4.1.1. I have submitted a pull request with the fix.

[sirinek]

@ksemaev The issue with system_log_rate_limit_interval and system_log_rate_limit_burst is also included in my pull request. The variables used in the template file were not in scope in rsyslog::config where the template file is called from.

[ksemaev]

With sirinek's commit worked perfectly