Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using:

root@u1210: /etc () # lsb_release -d
Description:    Ubuntu 12.10
root@u1210: /etc () # dpkg -l | grep rsyslog
ii  rsyslog                                   5.8.6-1ubuntu9                                    amd64        reliable system and kernel logging daemon

Today, I tried to read log from nginx log file but got this error:

Mar 11 17:34:18 u1210 kernel: imklog 5.8.6, log source = /proc/kmsg started.
Mar 11 17:34:18 u1210 rsyslogd: [origin software="rsyslogd" swVersion="5.8.6" x-pid="9742" x-info="http://www.rsyslog.com"] start
Mar 11 17:34:18 u1210 rsyslogd: rsyslogd's groupid changed to 103
Mar 11 17:34:18 u1210 rsyslogd: rsyslogd's userid changed to 101
Mar 11 17:34:18 u1210 rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
Mar 11 17:34:18 u1210 rsyslogd: the last error occured in /etc/rsyslog.conf, line 68:"$InputFilePollingInterval 10"
Mar 11 17:34:18 u1210 rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]

check config version that rsyslog using:

root@u1210: /etc () # ps -ef | grep rsyslog
syslog   18934     1  0 17:42 ?        00:00:00 rsyslogd -c5

I 've just used default config, addition below lines:

$ModLoad imfile

$InputFileName /var/log/nginx/access.log
$InputFileTag nginx:
$InputFileStateFile nginxxxx
$InputFileSeverity error
$InputFileFacility local7
$InputRunFileMonitor
$InputFilePollingInterval 10

here is config file: http://pastebin.com/8RnHXaDd

nginx log file is exist:

root@u1210: ~ () # ls -l /var/log/nginx/access.log
-rw-r----- 1 www-data adm 730040 Mar 11 17:49 /var/log/nginx/access.log

I see that rsyslog is default on ubuntu, debian, fedora and many other distro. First, I think that this 5.8.6 is too old so it does not provide text file input function, but after google around, same thing can done from 3.X.

What I'm doing wrong here?

addition question: I tried syslog-ng, the config file is very nice, it work nice on this function. But google around, it seem is not used widely as rsyslog. There no good comparison about them (almost are out dated). Which do you suggest, syslog-ng or rsyslog? (I use Ubuntu/Debian)

Thanks!

share|improve this question
    
Could you check if there is something in /etc/rsyslog.d/ directory ? –  Dom Mar 11 '13 at 11:25
    
@Dom: pastebin.com/XTRjdW7G there are 3 files in that dir –  HVNSweeting Mar 12 '13 at 2:16

2 Answers 2

rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]

rsyslogd: the last error occured in /etc/rsyslog.conf, line 68:"$InputFilePollingInterval 10"

According to this document, it should be

$InputFilePollInterval 10

instead of:

$InputFilePollingInterval 10
share|improve this answer
    
thanks, I got the "Polling" from that page (sample section). It help rsyslog run but still has not add nginx log to syslog. –  HVNSweeting Mar 12 '13 at 7:13
up vote 2 down vote accepted

solved problem.

It is about permission. /etc/rsyslog.conf has these lines:

$PrivDropToUser syslog
$PrivDropToGroup syslog

it drops privileges to syslog user and group after initialization.

/var/log/nginx/access.log only can be accessed by www-data and users in adm group.

Change $PrivDropToGroup syslog to $PrivDropToGroup adm make it works.

thanks @quanta for pointing out the error in $InputFilePollInterval directive.

share|improve this answer
    
+1. Glad to see you solve the issue. –  quanta Mar 12 '13 at 8:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.