Unable to setup Linux device (new version)

[nathanplatt]

Hello everyone,

I'm trying to reconfigure Nagios Log server using a VM image. The server configured fine without any issues but when trying to add a linux device I'm getting a familiar error from back in 2015.

Code: Select all

rsyslogd -f /etc/rsyslog.conf
rsyslogd: pidfile '/var/run/syslogd.pid' and pid 32259 already exist.
If you want to run multiple instances of rsyslog, you need to specify
different pid files for them (-i option).
rsyslogd: run failed with error -3000 (see rsyslog.h or try http://www.rsyslog.com/e/3000 to learn what that number means)

I looked up my old post here and it mentioned that this was a bug, so I followed its instructions but the script has been heavly modified since then and those fixes don't apply. This machine is running cloudlinux 7.4 and the log server is built directly from Nagios VMWare image on a virtual machine.

Any ideas?

[cdienger]

I found https://support.nagios.com/forum/viewto ... og#p236824 from 2017. I assume this is the old thread you were referring to? The fix should be scripts found in newer versions of NLS - have you upgraded to the 2.0.2 version?

https://assets.nagios.com/downloads/nag ... Server.pdf

Please provide the /etc/rsyslog.conf, files from the /etc/rsyslog.d/, and outpput of "rsyslogd -v" from the cloudlinux machine if the NLS has already been upgraded.

[nathanplatt]

I've just logged into NLS and its collecting the logs from enterprise, but the script error still remains.

Here's the rsyslog.conf

Code: Select all

cat /etc/rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###

cd /etc/rsyslog.d/
[root@enterprise rsyslog.d]# ls
90-nagioslogserver_var_log_httpd_access_log.conf 99-nagioslogserver.conf cagefs-syslog-socket.conf.bak
90-nagioslogserver_var_log_httpd_error_log.conf cagefs-syslog-socket.conf listen.conf
[root@enterprise rsyslog.d]#

Code: Select all

[root@enterprise rsyslog.d]# rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.
[root@enterprise rsyslog.d]#

Code: Select all

[root@enterprise rsyslog.d]# cat 90-nagioslogserver_var_log_httpd_access_log.conf
$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/lib/rsyslog

# Input for apache_access
$InputFileName /var/log/httpd/access_log
$InputFileTag apache_access:
$InputFileStateFile nls-state-var_log_httpd_access_log # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages
# from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

# Forward to Nagios Log Server and then discard, otherwise these messages
# will end up in the syslog file (/var/log/messages) unless there are other
# overriding rules.
if $programname == 'apache_access' then @@82.21.8.155:5544
if $programname == 'apache_access' then ~
[root@enterprise rsyslog.d]#

Code: Select all

[root@enterprise rsyslog.d]# cat 90-nagioslogserver_var_log_httpd_access_log.conf
$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/lib/rsyslog

# Input for apache_access
$InputFileName /var/log/httpd/access_log
$InputFileTag apache_access:
$InputFileStateFile nls-state-var_log_httpd_access_log # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages
# from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

# Forward to Nagios Log Server and then discard, otherwise these messages
# will end up in the syslog file (/var/log/messages) unless there are other
# overriding rules.
if $programname == 'apache_access' then @@82.21.8.155:5544
if $programname == 'apache_access' then ~
[root@enterprise rsyslog.d]# cat 90-nagioslogserver_var_log_httpd_error_log.conf
$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/lib/rsyslog

# Input for apache_error
$InputFileName /var/log/httpd/error_log
$InputFileTag apache_error:
$InputFileStateFile nls-state-var_log_httpd_error_log # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages
# from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

# Forward to Nagios Log Server and then discard, otherwise these messages
# will end up in the syslog file (/var/log/messages) unless there are other
# overriding rules.
if $programname == 'apache_error' then @@82.21.8.155:5544
if $programname == 'apache_error' then ~
[root@enterprise rsyslog.d]#

Code: Select all

[root@enterprise rsyslog.d]# cat 99-nagioslogserver.conf
### Begin forwarding rule for Nagios Log Server                            NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog # Where spool files will live             NAGIOSLOGSERVER
$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files     NAGIOSLOGSERVER
$ActionQueueHighWaterMark  8000 #                                         NAGIOSLOGSERVER
$ActionQueueLowWaterMark 2000 #                                           NAGIOSLOGSERVER
$ActionQueueMaxDiskSpace 1g   # 1GB space limit (use as much as possible) NAGIOSLOGSERVER
$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown         NAGIOSLOGSERVER
$ActionQueueType LinkedList   # Use asynchronous processing               NAGIOSLOGSERVER
$ActionResumeRetryCount -1    # Infinite retries if host is down          NAGIOSLOGSERVER
# Remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional        NAGIOSLOGSERVER
*.* @@82.16.34.92:5544                                                # NAGIOSLOGSERVER
### End of Nagios Log Server forwarding rule                               NAGIOSLOGSERVER
[root@enterprise rsyslog.d]#

So it looks like its worked but given a random error link before

[nathanplatt]

Addendum. I've just ran the same code of 3 other linux boxes all running centos7. 2 of them worked without issue and the final one gave a generic error of ERROR: rsyslog configuration check failed.

[cdienger]

What command are you running directly before getting this error message? I've tested the attached config and they appear to be good.

[nathanplatt]

I've logged in and re-ran the command and i've got no error. It must have been something on the server that caused the issue. Close the forum post, looks like a false positive!