Nagios Log Server and syslogd

[srg1970nj]

Neither command worked:

[[email protected] ~]# rsyslogd -f /etc/rsyslog.d/99-nagioslogserver.conf -N 1
rsyslogd: invalid option -- N
usage: rsyslogd [-46AdhqQvw] [-l hostlist] [-m markinterval] [-n] [-p path]
[-s domainlist] [-r[port]] [-tport[,max-sessions]] [-gport[,max-sessions]] [-f conffile] [-i pidfile] [-x]


[[email protected] ~]# rsyslogd -f /etc/rsyslog.conf -N 1
rsyslogd: invalid option -- N
usage: rsyslogd [-46AdhqQvw] [-l hostlist] [-m markinterval] [-n] [-p path]
[-s domainlist] [-r[port]] [-tport[,max-sessions]] [-gport[,max-sessions]] [-f conffile] [-i pidfile] [-x]

If I remove the -N 1 I get the following:

[[email protected] ~]# rsyslogd -f /etc/rsyslog.conf
Already running.

[[email protected] ~]# rsyslogd -f /etc/rsyslog.d/99-nagioslogserver.conf
Already running.

Let me know what to check next...

[cschwehr]

I see you've gone through the exact journey I started on... I found using: "cat /var/log/messages | grep rsyslog" helped me see what it was doing when the service created errors on startup.

2.0.6 is pretty old, it lacks some of the features of 5+ and I had issues with using any modules - as in didn't ever work with useful stuff like imfile. I ended up updating the dependancies and then compiling 5.7.1 since there isn't an RPM for EL4.

http://rpms.adiscon.com/v5-stable/epel-5/x86_64/RPMS/ - the have EL5 compatible versions but I haven't listed the dependancies.

You may want to check what it's doing and it's quite possible it's causing an error on syntax of the .conf file.

[srg1970nj]

That definitely pointed me in the right direction. I found the following:

Apr 28 12:39:16 csappia21 rsyslogd:could not load module '/usr/lib64/rsyslog/imfile', dlopen: /usr/lib64/rsyslog/imfile: cannot open shared object file: No such file or directory

There is no imfile in that directory. Based on what was indicated it appears imfile will not work with my current version of rsyslog. The problem is the server I am trying to work with is running Red Hat 5.4 (Tikanga). The link provided looks like everything is for Centos. Will one of those packages work with my current version of Red Hat? If yes, which one?

Thanks!!!!

[jolson]

cschwehr, I appreciate the input - it's nice to hear back from you. I'm glad your solution is working!

srg1970nj, any chance you could give the troubleshooting methods suggested by cshwehr a shot? Specifically, check for errors in the system log:

Code: Select all

cat /var/log/messages | grep rsyslog

Any chance there's something useful there? If not, rsyslog might need to restart to spit out useful information.

You could build rsyslog 5.x from the yum repository provided - I attempted to do this on CentOS 5 and found the following worked:

Code: Select all

cd /tmp
wget http://rpms.adiscon.com/v5-stable/rsyslog.repo
mv rsyslog.repo /etc/yum.repos.d/
yum install rsyslog

This pulls together a working version of rsyslog - I also had to create a spool directory for rsyslog to operate properly:

Code: Select all

mkdir /var/lib/rsyslog
chmod 700 /var/lib/rsyslog

That got my box up and running properly - the script was able to run and logs started showing up. Any chance you could give the above a shot and let me know if it works for you?

If you're nervous about installing via unknown RPM as I was, here is an official rsyslog post recommending these repositories: http://www.rsyslog.com/rhelcentos-rpms/

Best,


Jesse

[srg1970nj]

Jolson thank you very much, that worked. I am now able to monitor files on the server. Thanks again!!!!

[jolson]

I'm glad to hear that - no problem! I'll lock this thread. Feel free to open another one if you have further questions or issues. Thanks!