Rsyslog: impstats module does not bind to a specified rule set if log.syslog="off", does not warn it's a config mistake, and docs are not explicit about the dependency

[JPvRiel]

https://www.rsyslog.com/doc/v8-stable/configuration/modules/impstats.html doc does not make it clear that if a user sets log.syslog="off", then ruleset= will have no affect. It's probably implied and users with a deeper understanding of rsyslog might expect this, but it caught me out. It would probably be a good safeguard if rsyslog impstats module raised a warning or error when log.syslog="off" is set and ruleset= is also present.

E.g. Ruleset section

Binds the listener to a specific ruleset.

E.g. log.syslog section

This is a boolean setting specifying if data should be sent to the usual syslog stream. This is useful if custom formatting or more elaborate processing is desired. However, output is placed under the same restrictions as regular syslog data, especially in regard to the queue position (stats data may sit for an extended period of time in queues if they are full).

Example config on CentOS7 in /etc/rsyslog.d/impstats.conf with the adiscon repo rsyslog version 8.36 installed via yum:

module(
  load="impstats"
  interval="5"
  resetCounters="on"
  log.syslog="off"
  log.file="/tmp/rsyslog_impstats_file.log"
  ruleset="rsyslog_stats"
)

ruleset(name="rsyslog_stats") {
  action(
    name="rsyslog_stats_omfile"
    type="omfile"
    file="/var/log/rsyslog_stats_ruleset.log"
  )
}

To experiment, with log.syslog="off" (as above):

systemctl restart rsyslog.service
logger 'impstat ruleset working?'
sleep 5
ls -1 /var/log/*stat* /tmp/*stat*

Output

ls: cannot access /var/log/*stat*: No such file or directory
/tmp/rsyslog_impstats_file.log

So ruleset and action to output to file /var/log/rsyslog_stats_ruleset.log didn't run.

Then, change config to log.syslog="on":

systemctl stop rsyslog.servicesystemctl stop rsyslog.service
rm -f /tmp/*stats* /var/log/*stats*
sed -i 's/log.syslog="off"/log.syslog="on"/' /etc/rsyslog.d/impstats.conf
systemctl start rsyslog.service
logger 'impstat ruleset working?'
sleep 5
ls -1 /var/log/*stat* /tmp/*stat*

And the result of output files is now as expected

/tmp/rsyslog_impstats_file.log
/var/log/rsyslog_stats_ruleset.log

[rgerhards]

thx, good find. Would you be willing to update the doc at https://github.com/rsyslog/rsyslog-doc? I'll look for a small patch to impstats.

[JPvRiel]

update the doc at https://github.com/rsyslog/rsyslog-doc

https://github.com/rsyslog/rsyslog-doc/pull/703

First time doing PR to the project and using restructured text, so please double check.

[rgerhards]

thx, CI for the doc pr so far looks good. The buildbot slave also has created a preview for you: http://ubuntu16.rsyslog.com/doc/doc-2018-07-06-13-10-24-ca87efb/configuration/modules/impstats.html -- you'll find that URL when you check the CI run (just so that you know).

[rgerhards]

updated CI link as my clipboard was not with me ;) http://ubuntu16.rsyslog.com/doc/doc-2018-07-06-13-10-24-ca87efb/configuration/modules/impstats.html

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.