Rsyslog's imfile plugin not working on CentOS 7? - file

Question

I am trying to get Rsyslog's imfile plugin working without
any real success.
Here is useful OS version information:
# cat /etc/centos-release
CentOS Linux release 7.1.1503 (Core)
And here is Rsyslog version information:
# rsyslogd -v
rsyslogd 7.4.7, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
See http://www.rsyslog.com for more information.
I tried both legacy and RainerScript format of the configuration.
None of them works for me, sadly. I must be doing something completely wrong
but I simply can not decide on what it could be.
Here is my actual testing configuration (in RainerScript, the
former legacy version I tested was exactly the same in it's meaning):
# cat /etc/rsyslog.conf
global(
workDirectory = "/tmp"
)
module(
load = "imuxsock"
)
module(
load = "imjournal"
stateFile = "journal.state"
)
module(
load = "imfile"
pollingInterval = "10"
)
ruleset(name = "test-ruleset") {
if $syslogtag contains "test-syslogtag" then {
action(
type = "omfile"
file = "/tmp/test-file.log"
)
stop
}
}
input(
type = "imfile"
tag = "test-syslogtag"
stateFile = "test-input.state"
facility = "daemon"
severity = "debug"
file = "/tmp/test-input.in"
ruleset = "test-ruleset"
)
if prifilt("*.*") then {
action(
type = "omfile"
file = "/tmp/rsyslog-testing.log"
)
}
No warning nor error are produced by the Rsyslog with the above
configuration but also nothing from the /tmp/test-input.in file
is copied to the /tmp/test-file.log.
(I also double-checked the /var/log/audit/audit.log, of course, and ...
nothing suspicious is there. Being desperate on what's going on, I also
tried to setenforce 0 to switch SELinux off completely and to restart
the Rsyslog afterwards. It did not helped so the root cause of the problem
may not be SELinux-related issue.)
Also, the test-input.state file is correctly created in the global
workDirectory path (/tmp in this testing case). I also tried
standard paths (logs in /var/log, state file in /var/lib/rsyslog)
and it does not work either although all related files were created properly.
What's weird: I can not see any change in the state file if I populate the
input log file with some testing data even after Rsyslog restart using
# systemctl restart rsyslog (it should update the state file by default).
Just to point out: the imjournal and imuxsock plugins work and populate the fallback log file /tmp/rsyslog-testing.log correctly. Also
manually running Rsyslog on foreground with -D and/or -d options
did not helped me much to clarify why the imfile plugin does not work
for me in this particular configuration.
So, could you please
check my RainerScript syntax whether there is no obvious fault (I guess there is no such),
show me some working imfile plugin configuration on EL7?
Thank you very much.
--
mjf

Answer 1

With a few minor changes it finaly started to work properly. I think the
main root cause of the problem in my case must have been my testing it in
the /tmp directory where Rsyslog does not seem to work properly for some
reason on CentOS 7.
(May it be the /tmp is populated by the File System Namespace even
despite the fact that Systemd option PrivateTmp is not set to true in
the Rsyslog unit file and this option should be set to false by
default according to the Systemd manual page? This is higly unprobable, but
I haven't managed myself to dig more further into it yet. If I find it out,
I will update this answer.)
The other minor cause might have been incorrect filter written in
RainerScript (my real testing instance contained a horrible typo I
simply over-looked). So here is the resulting testing configuration that
works like charm for me.
# cat /etc/rsyslog.conf
global(
workDirectory = "/var/lib/rsyslog"
)
module(
load = "imuxsock"
)
module(
load = "imjournal"
stateFile = "journal.state"
)
module(
load = "imfile"
pollingInterval = "10"
)
ruleset(name = "test-ruleset") {
if $programname == "test-syslogtag" then {
action(
type = "omfile"
file = "/var/log/test-file.log"
)
stop
}
}
input(
type = "imfile"
tag = "test-syslogtag:"
stateFile = "test-input.state"
facility = "daemon"
severity = "debug"
file = "/var/log/test-input.in"
ruleset = "test-ruleset"
)
if prifilt("*.*") then {
action(
type = "omfile"
file = "/var/log/rsyslog-testing.log"
)
}
A little hint for those not knowing it - the $syslogtag and the
$programname seem to be close relatives: $syslogtag := $programname ":".
You can easily find out all the $ prefixed variables you can match against
by using RSYSLOG_DebugFormat output template which is already compiled in.
I hope it helps.
--
mjf